Free security check for small businesses: what you can test yourself

Small businesses can check several important security questions themselves for free: whether company addresses appear in data breaches, whether multi-factor authentication is on, whether software is up to date, whether backups can be restored and whether your domain is protected against forged senders. Such a self-check does not replace a professional review, but it shows the biggest gaps first.

Seven points for the self-check

Data breach check of the company domain: do addresses or credentials of your company appear in known sources?
Multi-factor authentication: is it active for email, cloud services, VPN and administrator accounts?
Passwords: is a password manager used, or are passwords reused and shared?
Updates: are operating systems, browsers, routers, firewalls and website plugins up to date?
Backups: is there a separately stored backup, and has restoring it been tested?
Email protection: are SPF, DKIM and DMARC set up for your domain?
Access: are accounts of former employees locked and administrator rights limited to what is needed?

In which order?

Start with the points that take little effort and achieve a lot: the data breach check of your domain and multi-factor authentication for email and administrator accounts. Next come a test restore of a sample file from your backup, a list of the software in use with its update status and a check of your email settings. Many email providers offer free checking tools for this.

What a self-check does not do

A self-check covers known standard gaps. It does not test whether your systems can be attacked, and it assesses neither your obligations under NIS2 or the GDPR nor your specific threat situation. The data breach check too is a snapshot: no result is not proof that nothing happened.

When to get external help

If you suspect a security incident
For regulatory or contractual requirements such as NIS2, DORA, ISO 27001 or customer audits
For critical systems or an online shop with customer data
If you cannot assess findings with confidence

First assessment for NIS2, DORA and KRITIS

Whether regulation affects your company is what the non-binding self-check by APASEC at apasec.de/selfcheck gives a first assessment of. APASEC operates BreachFinder and also offers consulting.

Frequently asked questions

Is the data breach check really free?

Yes. The security check for your domain is free and non-binding. Only the optional, more detailed reports are paid.

How often should I repeat the self-check?

Set a fixed rhythm, for example quarterly, and repeat it after major changes and after every incident.

Is a self-check enough for NIS2?

No. NIS2 requires documented risk management and further measures. A self-check is a first step, not proof of compliance.

Is your domain affected? The free BreachFinder check shows known data breaches for your domain.

Related guides

Updated: 2026-09-26. General information, not legal advice.