Cybersecurity Awareness Month: Six Questions Every Business Should Be Able to Answer

2 days ago

4 min read

Your employees know to be careful with suspicious emails.

But what happens when an invoice arrives from a vendor’s real email account?
When an old employee’s login still works?
Or when a backup reports “successful,” but nobody has tried restoring the software your business needs?

October is Cybersecurity Awareness Month, and it’s a good time to look beyond reminders and training.

For business owners, the next step is asking whether everyday security practices actually support the way your company operates.

Here are six questions to bring to your next conversation with your IT provider.

1. How Do We Verify Requests Involving Money?

Imagine your accounting team receives a familiar-looking invoice with updated banking instructions. The amount is expected. The timing makes sense. Nothing seems unusual.

That still does not prove the request is legitimate. Business email compromise can involve criminals taking over a real email account and using an existing conversation to redirect a payment.

Create a clear rule: verify changes to payment instructions through a separate, trusted channel. Call a number already in your records rather than one supplied in the message.

Ask your team: “Who confirms a banking change before money moves?”

2. Are We Protecting Every Way Into the Business?

Email is an important place to use multifactor authentication, but your review should also cover remote access, financial applications, and administrator accounts.

Ask your IT provider where MFA is enforced and whether phishing-resistant options, such as security keys or properly implemented passkeys, are available. CISA and its partners recommend phishing-resistant MFA as part of ransomware prevention.

Employees should also know to report unexpected login approval requests.

A useful question is: “Which important accounts still rely on a password alone?”

3. Who Checks That Updates Actually Installed?

Scheduling updates is one step. Confirming they worked is another.

A laptop that rarely connects to the company network may miss maintenance. A firewall or business application may need a separate update process.

Ask your IT provider how failed updates are tracked and how actively exploited security flaws are prioritized. Equipment that no longer receives security fixes also needs a replacement or risk-reduction plan.

“Updates are automatic” should be the beginning of the conversation.

4. Can We Restore the Work We Need to Do?

A backup notification tells you a job ran. A recovery test helps show whether you can use the result.

Pick a business process, such as scheduling appointments, processing orders, or accessing project files. Then ask what restoring that process would require.

Would you need a server, application settings, cloud data, or help from a software vendor?
How long would recovery take?

Backups should include protected copies that an attacker cannot easily alter or delete, such as configured offline or immutable backups. Regular restoration tests help identify problems before an emergency.

5. Does Everyone Know How to Report Something Suspicious?

An employee opens an unexpected attachment and immediately realizes something feels wrong.

Do they know whom to contact?
Can they reach that person without using company email?
Will they report it quickly, or hesitate because they are worried about getting blamed?

Give employees a simple reporting process and encourage them to speak up promptly, even when they are unsure.

Your response plan should also identify:

Who coordinates IT support?
Who makes leadership decisions?
Who is your outside assistance?

Keep essential contact information accessible if normal systems are unavailable.

6. What Happens After We Find a Gap?

A security review is only useful when someone follows through.

For each issue:

Assign a person responsible
A target date
A way to confirm the work is complete

That might mean protecting an overlooked account, replacing unsupported equipment, testing a restore, or practicing how the team would handle an outage.

Ask your IT provider: “What are our most important unresolved risks, and what is the plan for addressing them?”

Make October the Starting Point

You do not need to become a cybersecurity expert to ask practical questions about your business.

You should be able to understand what is protected, where gaps remain, and who is responsible for the next step.

At CETech, we help businesses throughout Rochester, Buffalo, and Syracuse manage and protect the technology they depend on.

Ready to take a closer look?

Contact CETech to discuss your cybersecurity concerns and the next steps for your business.

Frequently Asked Questions:

What should a business review first?

Start with the systems and accounts your business depends on most. Review who has access, whether multifactor authentication is enabled, how updates are managed, and when backups were last tested. Your IT provider can help prioritize the gaps.

Is employee cybersecurity training enough to protect our business?

Training is one part of protection. Employees also need safeguards such as secure account access, updated systems, and a clear way to report suspicious activity. Recovery planning helps prepare your business if an incident occurs.

How often should we test our backups?

Test backups regularly and after significant changes to your systems. The schedule should reflect how much downtime and data loss your business can tolerate. Ask your IT provider to document what was restored, whether it worked, and how long it took.

What should an employee do after clicking a suspicious link?

Report it to your IT team immediately and follow your incident response procedures. Explain what happened and whether any information was entered or files were downloaded. Avoid trying to investigate or fix the issue yourself, which could complicate the response.

How can CETech help us improve our cybersecurity?

CETech helps businesses assess security concerns and manage the technology they rely on. Whether you need managed IT support or help alongside your internal team, we can discuss your current setup and practical next steps.