Twenty-five questions, honest answers, a plan
Security questionnaires are usually filled in for someone else — an insurer, a customer. This one is for you: answer honestly, see what is missing, and fix the high-priority items first. Nobody else sees the answers.
- Runs entirely in your browser
- Works offline
- No upload
- No sign-up
- No watermark
Loading the tool…
How it works
- Answer each question: done, partly, no, or not applicable — “partly” is the most useful answer.
- Read the gaps, most important first, each with why it matters.
- Print the action plan with owner and due-date columns, or export Markdown.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see fetch the tool’s own code — and, for a few heavy tools, their open-source engine from a public CDN — plus one small page-view ping to loreatec.jp (page address and title, nothing more). None of them carry your file.
Frequently asked questions
Which standard is this based on?
On the baseline every SME framework converges on: IPA’s five-minute security self-diagnosis for small companies in Japan and the five control areas of the UK’s Cyber Essentials, plus the backup and incident items those two assume. The wording is our own; items are tagged with the Cyber Essentials area where one applies.
Will this tell me if I qualify for cyber insurance?
No — no tool can, because requirements differ by insurer, country and policy. What is true generally: insurers keep asking about the same handful of controls — MFA on e-mail and remote access, endpoint protection, offline or immutable backups, patching, staff training and an incident plan. Those are all in this check, marked high priority, so a “done” across them is a good sign; the insurer’s questionnaire is the authority.
Why is there no overall score?
Because a score invites gaming and hides what matters: one “no” on offline backups outweighs ten “done” elsewhere. You get counts and a priority-ordered gap list instead.
Where do my answers go?
Nowhere. They live in the page, and in this browser only if you tick “remember”. That is the point of running it here rather than on a vendor’s form.