Question 1

Is there a clear person who owns security and compliance decisions, even if it is only part of their job?

This does not need to be a full-time role or a hire. It just means someone is clearly accountable.

No clear owner People assume the developers handle it Someone usually takes the lead, but it is informal A clear owner exists and checks in regularly A clear owner exists, with a documented roadmap

Question 2

If a customer, partner, or new hire asked for your security policies and documentation today, could you produce them?

Think about a customer security questionnaire or a new team member landing tomorrow.

We have nothing written down We have a little, but it is out of date or incomplete We have the basics, but gaps would show We could produce most of what would be asked for Yes, our documentation is current and ready

Question 3

Is access to production infrastructure, the codebase, and admin panels protected by MFA and limited to people who need it?

Think about your cloud environment, your repository, and any internal admin tools.

Hardly ever Only on a few systems On many important systems, but not all On nearly all important systems Yes, consistently, with least-privilege access

Question 4

When someone leaves the team or changes role, is their access to production systems and customer data revoked promptly?

This includes staff, contractors, and any third parties with standing access.

No, this is ad hoc We usually catch the obvious ones, but not reliably We have a basic process, but it is easy to miss things We usually handle this properly Yes, this is handled consistently and quickly

Question 5

Do you know what customer data you collect, where it is stored, and who can access it?

Think about your data flows end to end, not just where the database lives.

Not really We have a rough idea We know the main flows, but not everything We have this reasonably well mapped Yes, this is documented and kept current

Question 6

Are your APIs and third-party integrations reviewed for security before they go live?

Think about API design, authentication, and what access third-party tools and services hold.

No, we ship and find out later Occasionally, if something feels risky Sometimes, but it is not consistent Yes, mostly Yes, this is a consistent part of how we build

Question 7

Do you know which of Cyber Essentials, ISO 27001, GDPR, the EU AI Act, or the EU Cyber Resilience Act actually apply to your product and market?

Most founders do not know this until a customer or regulator raises it.

No, we have not looked into this We have a rough sense, but nothing confirmed We know some of it, but not the full picture We have a reasonably clear picture Yes, we have this mapped and understood

Question 8

If asked, by a customer, an auditor, or as part of a certification process, could you evidence your compliance posture with real documentation?

A verbal answer is not the same as evidence a formal review will accept.

No, we would be starting from scratch We have fragments, but nothing pulled together We could put something together with notice We could largely evidence this already Yes, this is ready to go today

Question 9

If you had a data exposure or breach tomorrow, would you know your ICO notification obligations and what to tell your users and stakeholders?

You do not need a thick document. A short, usable plan is enough.

No, we would be working it out on the spot We have rough ideas, but nothing clear We have some notes or partial steps We have a simple plan for the basics We have a clear plan and key people know it

Question 10

Do you have logging and monitoring in place that would let you detect and investigate a security incident in your product?

Think about whether you would know something was wrong before a customer told you.

No meaningful logging or monitoring Basic logging exists, but nobody reviews it Some monitoring exists, but coverage is patchy We have reasonable coverage and review it periodically Yes, we would detect and could investigate confidently

Get a quick picture of your current security foundations and where you may need to focus next.