Question 1

What does the Cyber Hygiene Test measure?

Accepted Answer

Twelve controls from the CIS Controls v8.1 Implementation Group 1 baseline: multi-factor login, least privilege, patching, endpoint protection, backups, email protection, training, inventory, logging, encryption, vendor risk and incident response. It is the same baseline the UAE IA Standard v2 and ADHICS build on, so the score speaks the regulators’ language.

Question 2

Where do the coverage percentages come from?

Accepted Answer

The CIS Community Defense Model v2.0 found that the IG1 baseline defends against 77% of the attack techniques used across the top five attack types and 78% of ransomware techniques. Your coverage is a proportional estimate from how many of those controls you have in place.

Question 3

What is a cyber hygiene checklist?

Accepted Answer

The routine habits that stop most attacks: multi-factor login on every account, automatic software updates, tested backups kept offline, a list of every device and account you own, removing access when people leave, and basic staff training. The recognised checklist for small firms is CIS Controls Implementation Group 1, which the Center for Internet Security calls essential cyber hygiene.

Question 4

What is a security score, and what is a good one?

Accepted Answer

A number that summarises how many recommended safeguards you have in place, usually out of 100 or as a letter grade. Scores differ by tool (Microsoft Secure Score, insurer scans and CIS-based assessments measure different things), so compare your score against the same tool over time rather than against another company. A useful score tells you which gap to fix next.

Question 5

What are the CIS Controls IG1?

Accepted Answer

CIS Controls version 8.1 has 18 controls and 153 safeguards. Implementation Group 1 is the starter subset of 56 safeguards for organisations with limited IT staff: asset and software inventory, data protection, secure settings, account and access management, vulnerability management, logging, email and browser protection, malware defences, recovery, network basics and awareness training.

Question 6

How often should a business check its security?

Accepted Answer

A hygiene self-check quarterly and a professional assessment at least once a year, or after any big change: a new office, a new cloud system, a merger, major staff turnover. Regulated businesses often have a required cadence, and DoH, DHA and the financial regulators ask for evidence at renewal. The read-only compliance agent keeps the picture current between checks.

How much of the attack actually gets through? Find out in three minutes.

What kind of business are you?

How many people work there?

What is in your environment? Pick all that apply.

What the score measures, and what a good one looks like.

Bring your score. Leave with a plan and a fixed fee.

Location

Email

Phone