Five questions for your IT administrator
What an executive can ask without IT knowledge, and what a good answer looks like.
4 November 2026 · P1R4T3 Research
These questions need no IT knowledge. Put them to your IT administrator or external IT provider, and ask for evidence with each answer. A missing answer is not a reason for blame, but a task to complete.
One-page printable version (PDF)
1. When did we last restore data from backup?
Good answer: a specific date and a record, plus a copy that cannot be reached from the network or deleted. Having a backup is not the same as being able to recover.
2. Is multi-factor authentication enabled for everyone?
Good answer: a list from the admin console that includes administrator accounts. Ask about exceptions and the reasons for them.
3. What of ours can be reached from the internet?
Good answer: an up-to-date list of exposed services and their owners. Remote desktop (RDP) should not be directly reachable; remote access should go through a VPN with multi-factor authentication.
4. Who can reach our systems from outside?
Good answer: a named list of external companies and vendor remote maintenance: which account, when, with what logging. Access is best opened only when needed.
5. Who does what when something goes wrong?
Good answer: a printable page with the decision maker, contacts and the notification deadlines owed to partners and authorities. It is worth walking through it once as a rehearsal.
If the answers are incomplete
These points can usually be addressed at modest cost, and supplier questionnaires tend to ask about similar things. More detail: ten pitfalls of the supplier questionnaire. If a partner has sent you a questionnaire, our NIS2 quick assessment helps you assess your position for a fixed fee. It is not an official audit and does not certify compliance.