KMU Cyber-Audit

Forty employees, no IT department, and a customer wants to know how your IT security is doing. KMU Cyber-Audit walks you through the 27 requirements of the German CyberRisikoCheck — in plain language, no jargon, with a result on paper at the end.

WHAT THE CHECK IS BUILT ON
DIN SPEC 27076 was published in 2023 and developed together with the German Federal Office for Information Security. It describes an advisory service for small and micro businesses up to roughly fifty employees: 27 requirements in six topic areas, five of them highlighted as TOP requirements because they close the most common routes of attack. No certificate, no mountain of paperwork — a stocktaking that fits a business which also has to run itself.

WHY SMALL BUSINESSES DO THIS
• Because an encrypted server without a backup stops the business for weeks, and most attacks on small companies are not targeted but automated
• Because customers, contracting authorities and cyber insurers now send questionnaires that have to be answered
• Because the official CyberRisikoCheck with an IT service provider goes more smoothly if you already know where you stand
• Because "we really should do something about it" needs a list you can work through

THE SIX TOPIC AREAS
• Organisation & awareness — 7 requirements
• Identity and access management — 3
• Data backup — 4
• Patch and change management — 3
• Protection against malware — 3
• IT systems and networks — 7
From the emergency contact through two-factor sign-in and a restore test for your backup to keeping the guest network away from the company network.

STEP BY STEP INSTEAD OF JARGON
For every requirement: one sentence for the owner on why it matters. Three to five steps a business without an IT department can actually take. The mistakes that typically happen along the way. What works as evidence. Plus effort, ownership — management, IT, service provider or staff — and suitable tools, open source first.

WHERE YOU STAND
Ratings from 0 (not implemented) to 4 (continuously improved), maturity per topic area and overall, radar chart, gap analysis. Quick-start mode shows only the TOP requirements — enough for a first evening.

THE RESULT AS A PDF
Management summary, overview with gap analysis, every open requirement in full length, detail pages with your notes. IT service providers add their firm, logo and colour and pass the report straight to their clients. CSV export included.

SEVERAL BUSINESSES, SEVERAL YEARS
Each assessment carries its own company details — for your own business or for client engagements. The comparison shows the progress.

YOUR BUSINESS, YOUR DATA
Everything stays local on the device. No account, no cloud, no tracking, no network request. Face ID or Touch ID lock optional, backup as a portable file.

FREE AND PRO
One requirement per topic area — six of 27 — stays free forever, ratings and radar included. Pro opens the rest and adds the PDF report, CSV and backup export, report branding and unlimited assessments — monthly or yearly subscription, or a one-time purchase that never renews.

LANGUAGES
German (original), English, French, Italian and Romansh as clearly marked translations.

WHAT THIS APP IS NOT
Not an official CyberRisikoCheck: that one requires a qualified IT service provider to carry it out. This app is the self-assessment before or alongside it; the requirements are paraphrased, DIN SPEC 27076 prevails. Subscriptions renew automatically until cancelled in the App Store settings.

Terms of Use: https://treeinspired.com/terms.html
Privacy Policy: https://treeinspired.com/privacy.html