Rebootwe make IT work
Client PortalRequest a conversation →
When someone asks · 90-second self-check

Could you hand over the proof this afternoon?

Whether it is a cyber insurance renewal, IRS Form W-12 Line 11, a defense prime’s CMMC questionnaire, or a corporate client’s outside-counsel audit, they all ask variations of the same eight operational questions. Check where you stand before you sign an attestation.

100% browser-local · Zero answers transmitted, logged, or stored · Printable 1-page partner brief
01 · Choose the desk closest to yours

Underwriters and corporate clients ask for MFA on every mailbox, tested immutable backups, and written wire-verification rules.

02 · Answer honestly as of today (8 questions)
Cyber insurer · Every questionnaire
Does every email account, remote login, and admin role enforce phishing-resistant MFA — with zero shared passwords or SMS fallbacks on admin accounts?

A single legacy mailbox or global admin exception is the first clause an adjuster checks against what you attested on your application.

Underwriter · Auditor
Have you actually restored a critical system or database onto clean scratch storage on a stopwatch — not just read a green backup dashboard?

Backup jobs report success even when credentials drift, retention silently fails, or restoring takes four days instead of twenty minutes.

Managing principal · Continuity check
If your IT provider disappeared tonight, do you hold sealed break-glass admin access to your domain registrar, Microsoft 365 tenant, and firewall?

Businesses discover during an incident or breakup that a vendor registered their domain or holds the only Global Administrator key.

Forensic counsel · Privacy statute
Are external auto-forwarding rules blocked across your email tenant, with mailbox audit logs retained long enough to prove whether data left?

Business email compromise lives quietly in inbox rules. Without audit logs, counsel has to assume every file in the mailbox was exposed.

Insurer · Incident response
Does every laptop and server — including partner home machines that touch firm files — run 24/7 human-monitored endpoint detection and patching?

Unmanaged home PCs and stale remote-access tools are the #1 side door around a hardened office network.

Malpractice & cyber carrier · Closing deskDesk-specific
Is out-of-band voice verification on a known-good phone number enforced in writing before any trust, payoff, or disbursement wire changes?

Email threads around closing dates are routinely impersonated; carriers routinely exclude social-engineering losses without callback proof.

Corporate client · Outside-counsel guidelinesDesk-specific
Could you answer a 40-question client security questionnaire this afternoon with dated artifacts instead of aspirational promises?

Institutional clients increasingly hold panel renewals until outside counsel demonstrates encryption, access reviews, and incident playbooks.

Connecticut PA 21-119 · Statutory postureDesk-specific
Does your firm maintain a written cybersecurity program aligned to a recognized framework (such as CIS Controls or NIST CSF) that reflects actual configs?

Connecticut’s data-breach safe harbor rewards written, maintained alignment — paper templates that contradict live settings backfire under scrutiny.

How to use this check

Straight answers before you attest

Are my answers stored, tracked, or sent to Reboot?

No. Every toggle on this page runs strictly inside your browser tab with zero analytics beacons, cookies, or network calls. Refresh the tab and it resets; click Print Brief if you want a clean 1-page PDF for your own folder.

Does scoring 8 out of 8 guarantee cyber insurance approval or regulatory compliance?

No — and you should distrust any IT vendor who promises that. Insurers underwrite specific policy language and regulators evaluate legal facts. What this check measures is operational readiness: whether the controls exist in reality and whether you have dated written proof before someone asks.

What if we have most of these turned on, just nothing written down?

That is the most common spot good Connecticut firms are in. Turning a control on protects you Tuesday night; having the dated receipt protects you when an underwriter, auditor, or client counsel asks you to prove it.

Can we walk through our gaps without an awkward sales pitch?

Yes. Bring your printed brief (or just the two questions that bugged you) to a 15-minute call. We will tell you plainly what we would fix first, even if we are not the right fit to manage your environment.