# Nexus Vector LLC — Cyber Hygiene & Compliance Intake Form

**Welcome!** This secure intake questionnaire takes approximately **12–15 minutes** to complete. 
* **Zero Password Policy:** Please **never** enter or send us your passwords. 
* **How to Take a Quick Screenshot:** 
  * **Windows:** Press **`Windows Key + Shift + S`** to snip an area of your screen, then paste or save the file.
  * **Mac:** Press **`Command + Shift + 4`** to select an area of your screen (saves directly to your Desktop).
* **Next Steps:** Once you return this completed form and the requested screenshots to **`garrett@nexusvector.io`**, we will perform our passive, off-hours external perimeter review, score your controls against **CIS Implementation Group 1 (IG1)** and cyber insurance standards, and deliver your **Executive Risk Matrix & Custom SOP Binder** within 5 business days.

---

## Section 1: Public Perimeter & SOP Customization Info
*(Used for passive DNS/perimeter checks and auto-filling your custom Written Information Security Plan)*

### Q1. Company Legal Details & Primary Domain
* **Legal Business Name** *(as it should appear on your official compliance policies)*: 
  `[Enter Here]`
* **Primary Website / Email Domain** *(e.g., midwestmanufacturing.com + any secondary domains you own)*: 
  `[Enter Here]`
* **Physical Office Address(es)**: 
  `[Enter Here]`
* **Designated Security / Emergency Contact Name, Title, Email & Phone Number** *(for your Incident Response Plan)*: 
  `[Enter Here]`
* **Approximate Headcount** *(Total employees/contractors with company email or computer access)*: 
  `[Enter Here]`

### Q2. Public Static IP Address (Optional — Takes 10 Seconds)
* **Office Public IPv4 Address:** `[Enter Here or type "Remote"]`

> **Why we ask:** Insurance underwriters check if your office internet connection accidentally leaves Remote Desktop (Port 3389) or router login screens open to the public internet.
> **How to find it from your office desk:** While connected to your main office Wi-Fi or wired network, visit **[whatismyipaddress.com](https://whatismyipaddress.com)** and copy the **IPv4 address** shown (e.g., `65.29.xxx.xxx`). *(If your team is 100% remote, simply type "Remote").*

---

## Section 2: Identity, Email & Multi-Factor Authentication

### Q3. Cloud Email Provider & Multi-Factor Authentication (MFA) Status
Which platform powers your company email, and is Multi-Factor Authentication (MFA / 2-Step Verification) enforced for **every** user? *(Mark one with an "X")*

* [ ] **Microsoft 365** — MFA is enforced for 100% of users
* [ ] **Google Workspace** — 2-Step Verification is enforced for 100% of users
* [ ] **Partial** — MFA is turned on for owners/admins, but not all staff
* [ ] **Not Enforced / Unsure**
* [ ] **Other Email Host** *(cPanel, GoDaddy Webmail, On-Premise Exchange, etc.)*: `[Specify Here]`

> **📸 Screenshot Attachment #1 (Takes 60 Seconds):**
> Please attach or paste a screenshot of your email user list showing MFA status:
> * **If using Microsoft 365:** Log into `admin.microsoft.com` -> Click **Users** -> **Active users** -> Click the **Multi-factor authentication** button at the top (or go to `entra.microsoft.com` -> **Users** -> **Per-user MFA**). Take a screenshot showing your user list and their MFA status column (`Enforced` / `Enabled` / `Disabled`).
> * **If using Google Workspace:** Log into `admin.google.com` -> Click **Directory** -> **Users** -> Click **Manage columns** (gear icon) and add **2-Step Verification enrollment**. Take a screenshot of the user list.

### Q4. Global Administrator & Daily-Driver Account Separation
Do the people with "Global Admin" or "Super Admin" privileges use that exact same email account for everyday tasks (reading daily email, opening PDF attachments, browsing the web), or do they have a separate, dedicated admin login? *(Mark one)*

* [ ] **Pass:** Admins have a separate, dedicated admin account (e.g., `admin-jsmith@`) and use a standard non-admin account for daily email/web browsing.
* [ ] **Partial:** Only 1–2 owners have Global Admin rights, and they use that same regular email account daily.
* [ ] **High Risk:** 3 or more employees have Global Admin / Super Admin rights on their daily email accounts.
* [ ] **Unsure**

---

## Section 3: Backups & Ransomware Recovery

### Q5. Critical Business Data & Backup Architecture
Where does your company’s "crown jewel" data live (accounting, client records, CAD/production files, ERP/CRM), and how is it backed up? *(Mark all that apply)*

* [ ] **100% Cloud SaaS** *(QuickBooks Online, Microsoft SharePoint/OneDrive, Google Drive, industry cloud software)*
* [ ] **Local Server or NAS Drive** in our office/warehouse
* [ ] **Individual Employee Desktops/Laptops** without automatic cloud sync
* [ ] **Automated Cloud Backup** runs daily *(e.g., Acronis, Datto, Veeam, Backblaze, Carbonite, Synology C2)*
* [ ] **Offline / Immutable Copy:** Our backups are locked ("immutable") or unplugged ("air-gapped") so ransomware on a desktop cannot delete the backup history.

* **Backup Software / Vendor Name:** `[Enter Here]`
* **When was the last time you tested restoring a sample file or folder from backup?** *(Mark one)*
  * [ ] Within the last 90 days
  * [ ] Within the last 12 months
  * [ ] Never tested / Unsure

> **📸 Screenshot Attachment #2 (If applicable):** 
> Open your backup software dashboard or cloud backup summary screen and take a screenshot showing the **Last Successful Backup Date** and green status indicator.

---

## Section 4: Endpoints, Operating Systems & Antivirus

### Q6. Workstation & Server Operating Systems (End-of-Life Check)
Since standard **Windows 10 reached End-of-Life**, cyber insurers flag unpatched Windows 10 PCs or older Windows Server 2012 machines as immediate underwriting blockers. What operating systems run on your company computers? *(Mark one)*

* [ ] **Pass:** 100% of company PCs run **Windows 11**, supported **macOS**, or **Windows 10 with paid Microsoft Extended Security Updates (ESU)**.
* [ ] **Partial:** Most computers run Windows 11 / modern macOS, but we still have **1 to 3 older Windows 10 / Windows 7 / Server 2012 machines** connected to the network (e.g., running a legacy shop tool or front desk).
* [ ] **Fail:** Many of our computers still run standard Windows 10 without paid ESU or older operating systems.
* [ ] **Unsure**

### Q7. Antivirus / Endpoint Detection & Response (EDR)
How are company laptops and desktops protected against malware and ransomware? *(Mark one)*

* [ ] **Centralized EDR / Managed Antivirus:** All company computers run centrally managed security software *(e.g., Huntress, CrowdStrike, SentinelOne, Sophos, Microsoft Defender for Business, Malwarebytes/ThreatDown, Bitdefender GravityZone)*.
* [ ] **Built-In / Standalone Antivirus:** Each computer uses built-in Windows Security (Defender) or individual retail antivirus, not managed from a central console.
* [ ] **BYOD / Unmanaged:** Employees use personal laptops/PCs and we do not verify their antivirus or automatic updates.

* **Antivirus / EDR Software Name:** `[Enter Here]`

> **📸 Screenshot Attachment #3:** 
> If you have a central antivirus dashboard, attach a screenshot of the main overview showing the number of protected devices. Otherwise, on any typical company Windows PC, open **Windows Security** -> **Virus & threat protection** and snip a screenshot showing green checkmarks.

---

## Section 5: Office Network, Wi-Fi & Physical Security

### Q8. Office Wi-Fi & Network Segmentation (VLANs)
If a visitor, employee's personal cell phone, or smart TV/security camera connects to your office Wi-Fi, is it isolated from your main business computers and servers? *(Mark one)*

* [ ] **Pass (Segmented):** We have a separate **Guest / IoT Wi-Fi network** (or isolated VLANs) that blocks visitors, personal phones, and smart devices from seeing company computers or file shares.
* [ ] **Fail (Flat Network):** Everyone—company PCs, employee personal phones, smart TVs, cameras, and visitors—connects to the **exact same Wi-Fi network name and password**.
* [ ] **N/A:** 100% remote workforce with no physical office.

> **📸 Screenshot Attachment #4 (Takes 30 Seconds):** 
> On your computer or smartphone while at the office, open your **Wi-Fi network list** and take a screenshot showing the visible Wi-Fi network names (SSIDs) in your building (e.g., `Company_Corp` vs. `Company_Guest`).

### Q9. Router Security & Physical Equipment Closet
*(Mark all statements below that are TRUE for your primary office location)*

* [ ] Our main internet modem, firewall/router, and network switches/NVR are kept inside a **locked closet, locked server cabinet, or restricted back office** (not sitting out in a public reception area or unlocked hallway).
* [ ] The default factory administrator password on our router/firewall has been changed to a strong, unique password.
* [ ] Remote management (WAN admin login from the public internet) is disabled on our router/firewall.
* [ ] We have security cameras covering exterior entry doors and/or our main equipment room.

---

## Section 6: Existing Written Policies & Wire Transfer Controls

### Q10. Written Security Policies & Financial Fraud Verification
*(Mark all statements below that are currently in place at your business)*

* [ ] We already have a signed **Written Information Security Plan (WISP)** updated within the last 12 months.
* [ ] We already have a written **Cyber Incident Response Plan** (who to call if hit with ransomware or business email compromise).
* [ ] We already have a signed **Employee Acceptable Use & Password Policy**.
* [ ] **Dual-Verification for Wire/ACH Changes:** If a vendor, customer, or employee emails asking to update bank routing/ACH numbers or wire funds, our staff is strictly required to **call a known phone number on file** to verify verbally before sending money.
* [ ] **None of the written policies above are formalized yet** *(No problem—we are building and customizing all three written policies for your business as part of your audit packet!)*

---

## Submission Checklist & Authorization

Before returning this document, please confirm you have attached or pasted your 4 quick screenshots:
1. [ ] **Email MFA Status List Screenshot** (Question 3)
2. [ ] **Backup Status Dashboard Screenshot** (Question 5 — *if applicable*)
3. [ ] **Antivirus / Windows Security Status Screenshot** (Question 7)
4. [ ] **Office Wi-Fi Network Names (SSIDs) Screenshot** (Question 8)

**Client Authorization for Passive Perimeter Review:**
By submitting this intake form, I authorize **Nexus Vector LLC** to perform a passive, non-intrusive external security configuration review of the domain(s) and public IP address(es) listed in Section 1, and to prepare customized compliance documentation based on the responses provided above.

* **Authorized Name & Title:** `[Enter Name & Title]`
* **Date:** `[Enter Date]`
* **Return Completed Form & 4 Screenshots To:** `garrett@nexusvector.io`