Tool

Family security index

Ten areas, one honest question each. Answer them and this page scores the position in your browser. Nothing you select leaves your device.

This is a structured self-assessment, not an audit. A score here reflects only your own answers to ten questions, and a high score is not an assurance. The reviewed, evidenced version of this exercise is the family cyber review.

The ten questions

Answer as things actually stand, not as they were intended to be. An honest “partly” is more useful than a generous “in place”, and “not sure” is a legitimate answer that tells you something on its own. An unanswered area and a “not sure” both score nothing, because neither can be relied on.

1. Identity

Every important account, email, banking and cloud storage included, has its own strong password and two-step verification that does not rely on text messages.

2. Devices

The phones and laptops the family actually uses are current, updating themselves, and can be locked or wiped if one is lost.

3. Banking controls

No payment and no change of bank details is ever made on an emailed instruction alone. Verification on a known number is the rule, and the rule is written down.

4. Communications

The family knows which matters belong on which channel, and sensitive documents are not sitting in email threads.

5. Household

The home network separates guests and smart devices from the systems that matter, and someone knows what is connected to it.

6. Backups

The things that could not be replaced, documents, photographs and records, exist in more than one place, and a restore has actually been tested.

7. Assistants

Anyone acting for the family, whether a PA, a bookkeeper or household staff, has their own accounts, only the access their role needs, and a leaver process.

8. Advisers

There is a current list of who advises the family, what each one holds, and how each of them verifies a request that appears to come from you.

9. Succession

If the person who runs all of this were unavailable tomorrow, someone else could lawfully reach the essentials within days.

10. Incident response

The family knows who it would call first about a compromised account, an attempted fraud or a lost device, and that number is written down.

Your answers stay in this page. They are not saved, not stored on your device and not sent to this site or anywhere else. Refreshing or closing the page clears them, so print or write down anything you want to keep.

Your score

Family security index: self-assessment

Scored from my own answers using the family security index at danielmcclurefisher.co.uk. A self-assessment, not an audit.

Answer all ten questions and select “Score my answers”. The result appears here.

How to read the score

The index is a prompt for a conversation, not a measurement. It weights each of the ten areas equally, which is deliberate: the area a family has never thought about is usually the one that matters, and weighting the list would hide it.

A low score in one area is not a verdict on the family. It is a place to start, and starting in a sensible order matters more than starting everywhere at once.

From here

Four of the areas have written guidance behind them. A guide to how families and family offices are defrauded covers the banking controls and communications questions: how an emailed instruction moves money, and the verification habit that stops it. The payment verification protocol is the one-page rule itself, ready to print and adopt. The first 72 hours covers succession and incident response: what happens when the person who understood the whole arrangement is suddenly unavailable, and who gets called first. The identity question has two guides behind it: SIM swap: how a phone number is stolen on why a mobile number should not be a recovery route, and dark web monitoring, plainly on what a breach alert is and is not worth.

The family cyber review is the reviewed, evidenced version of this exercise. The same ground is covered by me rather than by you, the answers are tested rather than taken on trust, and the findings go in writing with a prioritised plan. Where an answer here was “not sure”, that is usually the first thing the review settles.

Have the position reviewed properly

If the exercise raised more questions than it answered, outline the situation and I will say plainly whether a review is the right starting point.

Start an enquiry Read about how I work