Cyber Hygiene Self-Assessment and Action Plan for Small Clinics and Schools

The problem small clinics and schools have with security

A five-doctor clinic or a private school with 400 students holds sensitive records: patient histories, fee payments, children's contact details. It usually has no security staff. IT is a part-time vendor or the owner's nephew. When the owner asks "are we safe?", nobody can answer, and the frameworks that exist are written for people who already know what "asset inventory" and "privileged access" mean.

The result is predictable: shared passwords on the reception PC, no multi-factor login on the email account that resets everything else, backups that were never tested, and a Windows install nobody has updated in a year. None of these needs a big budget to fix. They need someone to point at the five things that matter most and keep track of whether they got done.

What already exists and the gap

• NCSC Cyber Essentials Readiness Tool (UK): a free guided questionnaire, but it is built around UK certification and assumes some IT vocabulary.
• CIS Controls IG1 and the CIS SME Implementation Guide: 56 foundational safeguards for organisations with limited IT resources. Excellent content, but a PDF and spreadsheet, not a tool that tracks progress.
• SecurityScorecard and UpGuard: external rating platforms aimed at vendor risk teams in larger companies, priced accordingly.
• Managed service providers: good when affordable, but most small clinics and schools never engage one.

The gap is a tool that speaks the language of a clinic manager, maps answers to a respected framework behind the scenes, and turns the result into a short list of owned, dated actions rather than a score that makes people feel bad and then gets ignored.

What you build

A web app with three roles: owner (runs the assessment, sees everything), staff member (assigned actions, marks them done), and advisor (an optional IT helper invited to view and comment).

Main flows:

1. The owner signs up, describes the organisation (size, type, number of devices, whether they use Google Workspace or Microsoft 365) and answers the question bank. Questions adapt: no email domain means no email questions.
2. The app scores answers and produces a ranked action plan: "Turn on two-step login for the admin email account" ranks above "Write an incident response policy".
3. Optionally, the owner proves they control the domain with a DNS TXT record and the app runs a light external check of that domain only.
4. Actions are assigned, reminded and closed. A dashboard shows progress over time.

The technically interesting part

The hard part is the prioritisation model, not the forms. You need to encode, for each safeguard, how much risk it removes and how much effort it costs a small organisation, then rank the gaps. Document your weights and justify them from CIS IG1 and NIST CSF 2.0 guidance, and show your supervisor that two organisations with different answers get sensibly different plans.

The second interesting part is doing the external check ethically: it must only run against a domain the user has proven they control, it must be passive (DNS lookups, one HTTPS request, certificate inspection), and it must explain every finding in plain words.

How to evaluate it

• Usability: five or more real non-technical staff complete the assessment. Report median completion time and the questions where people chose "I don't know" most.
• Plan quality: give three anonymised assessments to a security professional or lecturer and ask them to rank the top five actions themselves. Measure overlap with your tool's ranking.
• Follow-through: after four weeks, how many assigned actions were actually closed in pilot organisations.
• External check accuracy: compare your domain findings against a manual check on ten domains you own or have permission to test.

Suggested plan

1. Weeks 1 to 3: read CIS IG1 and NIST CSF 2.0, interview three clinic or school managers, draft the question bank.
2. Weeks 4 to 6: data model, assessment flow, scoring engine with unit tests.
3. Weeks 7 to 9: action tracker, reminders, PDF report.
4. Weeks 10 to 11: domain ownership proof and passive external checks.
5. Weeks 12 to 14: pilot with real users, evaluation, write-up.

Path to a product

The first customer is an IT freelancer or small managed service provider who looks after several clinics or schools and needs a repeatable way to start conversations and show progress. Charge per managed organisation per month, with a free single-organisation tier. Later, partner with a medical association or a school network to offer it to members. The question bank and weights are the asset; keep them versioned.

Scope warning

Do not build an agent that installs on computers, a vulnerability scanner, or anything that probes networks. Do not scan domains without proof of ownership. Do not attempt certification; you are helping people start, not certifying them.

Learn what you need on Sefism

• Full stack roadmap : the web app, auth and database side of the project.
• NIST Cybersecurity Framework 2.0 : the framework your action categories map to.
• roadmap.sh: Cyber Security : fills in the security vocabulary you will translate into plain language.
• ISC2 Certified in Cybersecurity : a structured primer on the basics you are asking users about.
• Where to start in cybersecurity or IT operations : useful context if this project is your first step into security.

Get help with this idea

Scoping a security project is mostly about deciding what you will not defend against and how you will prove the rest works. If you want a second opinion on scope, stack or your evaluation plan, a mentor can review it with you; you still build it yourselves. New to Sefism? Create a free account first.

• Discuss this idea with a mentor
• Send a query to Tauseef
• Book a 1:1 session