If you were hacked tonight, could you show you’d done enough?

“Reasonable steps.” “Appropriate measures.” Whatever your regime calls it, the question after a breach is the same, and three minutes from now you’ll know where you stand.

The hard part isn’t the breach. It’s the question after it.

Breaches happen to careful, decent businesses every week; that part is close to inevitable. What decides how it goes is the question that always follows: “had you taken reasonable steps?” The Privacy Act often asks it. Directors’ duties ask it. Health records laws ask it. The GDPR asks it as “appropriate technical and organisational measures”. The businesses that answer well aren’t lucky; they prepared an answer before they needed one.

And “reasonable” doesn’t mean enterprise-grade. It means proportionate to a business your size, which is exactly what sector guidance, the legal profession’s guides among the first, points to.

Your score across the three things that decide how it goes.

No control checklists and no audit questions. Just the day itself: what would you do, who helps you, and what could you show? We never publish or sell your answers. See our privacy policy. Your report names where you’re ready, where the day would cost you, and the plain-English reason each one matters.

Twelve pages, written for your answers.

Not confident? That’s exactly who this is built for.