An IT quote for your business · Across Quebec Request a quoteFrançais

IT maturity assessment

Answer about twenty simple, jargon-free questions to take stock of your company's IT and identify your priorities.

The 8 topics

  • Backups
  • Access
  • Updates
  • Devices
  • Network
  • Cloud
  • AI
  • Continuity

An indicative result based on your answers: neither a certification nor a compliance opinion.

Your answers stay in your browser unless you request the detailed report.

1/8 Backups

The copies of your data that let you get back to work after an outage, a mistake or a stolen computer.

Is your important data (files, accounting, email) backed up automatically, without anyone having to remember?
Why this question?

A backup that depends on someone remembering is easily skipped during busy periods. An automatic, regular backup keeps a recent copy of what you need to resume operations.

Learn more : Canadian Centre for Cyber Security, Tips for backing up your information (ITSAP.40.002)

Is a copy of your backups kept somewhere other than the office, separate from your everyday computers?
Why this question?

A copy kept off site, and not permanently connected to your network, stays available if a problem affects the office or every connected device.

Learn more : Canadian Centre for Cyber Security, Tips for backing up your information (ITSAP.40.002)

In the past year, have you checked that you could restore a file or a system from your backups?
Why this question?

A backup is only useful if its content can be restored. A restore test confirms the copies are complete and shows how long it takes to get back up and running.

Learn more : Canadian Centre for Cyber Security, Tips for backing up your information (ITSAP.40.002)

2/8 Access and accounts

Who can sign in to your tools, and how their identity is checked.

Is a second check at sign-in (for example, a code sent to a cellphone) turned on for the company's email and online tools?
Why this question?

This second check is called multi-factor authentication (MFA). A guessed or stolen password is then no longer enough on its own to open the account.

Learn more : Canadian Centre for Cyber Security, Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)

When an employee leaves, are their access rights closed right away, including for online tools?
Why this question?

An account that stays active after someone leaves can still open your email, files or software. A list of each employee's access makes it easier to close them all.

Learn more : Security measures reference framework, Centre gouvernemental de cyberdéfense (in French), AC family

Are the accounts that can change everything (administrator accounts) limited to a few people and used only for those tasks?
Why this question?

Using a regular account for everyday work, such as reading email or browsing the web, limits what malicious software or a mistake can change.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

3/8 Updates

The fixes that keep your computers, servers and software up to date.

Do Windows, macOS and software updates install automatically, or on a schedule someone follows, on every computer?
Why this question?

Vendors release fixes for known security flaws. Automatic or scheduled installation helps make sure no computer is left behind.

Learn more : Canadian Centre for Cyber Security, How updates secure your device (ITSAP.10.096)

Do all your computers and servers run versions still supported by their maker, meaning they still receive security updates?
Why this question?

A system that is no longer supported stops receiving fixes. For example, Windows 10 support ended on October 14, 2025; our guide on the topic explains the options.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

4/8 Computers and devices

The computers, laptops and cellphones your team uses every day.

Do you have an up-to-date list of your company computers, laptops and cellphones, with the person who uses each one?
Why this question?

An up-to-date list shows which devices to protect and update, and helps you recover equipment when an employee leaves.

Learn more : Security measures reference framework, Centre gouvernemental de cyberdéfense (in French), CM family

Does every computer have protection software against malicious programs, updated automatically, with someone following up on its alerts?
Why this question?

Protection software blocks some malicious programs. Its alerts only help if someone reads them and acts on them.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

Are laptops protected so that someone who finds one cannot read what is on it (disk encryption)?
Why this question?

A lost or stolen laptop often holds email, client documents or saved passwords. Encryption makes that data unreadable without the user's sign-in.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

5/8 Network and Wi-Fi

The office Internet connection, the Wi-Fi and the equipment that connects them.

Does your Internet connection go through a business firewall, meaning a device that filters what comes into and goes out of your network?
Why this question?

The modem supplied by your Internet provider offers basic protection. A business firewall filters traffic more precisely and lets you see what happens on the network.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

Do visitors and personal devices use a Wi-Fi network separate from your employees' network?
Why this question?

A guest network gives visitors Internet access without opening up your computers, printers or shared files.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

Have the factory passwords on your router, Wi-Fi and other network equipment been changed?
Why this question?

Some factory passwords are the same for every device of a given model and are easy to find online.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

6/8 Cloud services

The online services you use, such as Microsoft 365 or Google Workspace, and the data you store in them.

Do you know what your cloud provider takes care of (for example, backups or security) and what remains your responsibility?
Why this question?

With a cloud service, responsibility for security is shared between the provider and your company. For example, a file deleted by mistake may not be recoverable after a certain period unless you have your own backup.

Learn more : Canadian Centre for Cyber Security, Cloud security risk management (ITSM.50.062)

Does the company keep control of the administrator accounts for its cloud services, rather than relying on a single employee or a former provider?
Why this question?

If the only administrator account belongs to someone who has left, or to a provider you no longer work with, managing your own services becomes difficult.

Learn more : Security measures reference framework, Centre gouvernemental de cyberdéfense (in French), AC family

Do you know in which countries the data you store with your cloud services is hosted?
Why this question?

Where data is stored affects which laws apply to it. In Quebec, Law 25 sets rules for sending personal information outside the province; our Law 25 guide explains them.

Learn more : Canadian Centre for Cyber Security, Baseline cyber security controls for small and medium organizations

7/8 Artificial intelligence (AI)

The AI tools your team uses, such as writing assistants, and the data entered into them.

Have you given your employees written rules on which AI tools they may use and what information must never be entered into them?
Why this question?

Text entered into an AI tool may be kept by its provider. Simple written rules help your team use these tools without entering information about your clients or employees.

Learn more : Canadian Centre for Cyber Security, Generative artificial intelligence (ITSAP.00.041)

Do you know which AI tools are used in the company, including those an employee started using on their own?
Why this question?

Many AI tools only need a free account, and AI features are also being added to software you already use. Knowing them is the starting point for any usage rules.

Learn more : Canadian Centre for Cyber Security, Generative artificial intelligence (ITSAP.00.041)

8/8 Continuity and incidents

What the company has planned to keep serving its clients during an outage or an incident.

Do you have a written procedure for a major outage or cyberattack: who to call, who decides and how to keep serving your clients?
Why this question?

A procedure prepared in advance, even one page long, avoids improvising. It lists who to contact, who makes decisions and how to reach your providers.

Learn more : Canadian Centre for Cyber Security, Developing your incident response plan (ITSAP.40.003)

Do you know which systems must be brought back first, and how long the company can do without them?
Why this question?

Knowing your essential systems, such as billing or order taking, and how long you can operate without them guides your backups and the order in which systems are restored.

Learn more : Security measures reference framework, Centre gouvernemental de cyberdéfense (in French), CP family

Do you keep a register of incidents involving personal information, such as a loss, unauthorized access or information sent by mistake?
Why this question?

According to Quebec's Commission d'accès à l'information, every business in Quebec must keep a register of these incidents, including those that do not present a risk of serious injury.

Learn more : Commission d'accès à l'information du Québec, confidentiality incidents and security measures for businesses (in French)

How the score is calculated

Each answer earns points: Yes, 3 points; Partly, 1.5 points; No, 0 points; I don't know, 0 points.

Some questions count more than others, with a weight from 1 to 3. The highest weight goes to basic practices that protect accounts and help you get back to business: automatic and tested backups, the second check at sign-in, updates and a written incident procedure.

For each topic, the points for each answer are multiplied by the question's weight and added up. The total is converted to a score out of 100 based on the maximum possible for that topic. The overall score is calculated the same way across all 22 questions.

"I don't know" is worth 0 points, like "No". The question is then marked "To check" in the report, because sometimes it only takes asking the right person.

The overall score sets the level: 0 to 39, Foundations to put in place; 40 to 64, Partial foundations; 65 to 84, Established practices; 85 to 100, Established and maintained practices. A topic below 65 is shown as a priority, up to 3 topics.

Frequently asked questions

How many questions are in the assessment?

The assessment has 22 questions in 8 topics. You can answer "I don't know": the question is then marked "To check" in the report.

Is the assessment free?

Yes. The assessment and the detailed report are free, and you see your score without leaving your contact details. The Courtier TI service is free for the business making the request.

What happens to my answers?

The score is calculated in your browser. Your answers, score and contact details are sent to the Courtier TI team only if you request the detailed report. See the privacy policy.

Does the score show whether my company meets Law 25?

No. The score is neither a certification, nor a compliance opinion, nor a security audit. To review your obligations, see our Law 25 guide or the Law 25 IT assessment page.

What happens if I want to act on a priority?

You can request a quote from your result. The Courtier TI team first contacts you to understand your project, then finds the best IT services firm to carry it out. That firm presents its quote to you. The assessment does not commit you to anything.

Updated on

A project for one of these priorities?

The Courtier TI team first contacts you to understand your project, then finds the best IT services firm to carry it out. That firm presents its quote to you. The Courtier TI service is free for the business making the request.

  • Free service
  • One request to fill out
  • Reply within 3 business days
Request a quote