View/Export Results
Manage Existing Surveys
Create/Copy Multiple Surveys
Collaborate with Team Members
OR
Sign inSign in with Facebook
Sign inSign in with Google

Cyber security questionnaire for employees with 14 survey questions

Fourteen questions for staff about reporting, everyday habits and what gets in the way. No right answers, about four minutes.

  • 14questions
  • About 4 minto answer
  • 3on reporting
  • 1 optionalopen answer
Use this template Try the survey first
Employee Cyber Security Survey · answer to move through it
Use this template
Question 1 of 14 About your work
Which of these is closest to the work you do?
Finance, payroll or paying invoices
Sales, marketing or dealing with customers
HR, legal or administration
Engineering, development or IT
Operations, production or field work
Management or leadership
Something else
Question 2 of 14 About your work
Which of these are a normal part of your working week?
Handling customer or staff personal data
Approving or making payments
Access to systems most colleagues do not have
Choosing or installing my own software
Working from a personal device
None of these
Question 3 of 14 Reporting something suspicious
If a message arrived today that looked like an attempt to trick you, where would you send it?
A report button in my email or chat app
An address or channel I already know
I would tell my manager
I would ask a colleague what they think
I would delete it and say nothing
I do not know
Question 4 of 14 Reporting something suspicious
In the last 90 days, have you reported anything that looked suspicious?
Yes, once
Yes, more than once
No, nothing came up
No, something came up and I let it go
I cannot remember
Question 5 of 14 Reporting something suspicious
What would slow you down before reporting something?
Not being sure it is really a problem
Worrying that I caused it
Not knowing who to tell
Thinking it is not worth anyone's time
Being too busy at that moment
Reporting before and hearing nothing back
Nothing would slow me down
Question 6 of 14 Everyday security
I know which of the things I work with count as sensitive.
1
2
3
4
5
Strongly disagreeStrongly agree
Question 7 of 14 Everyday security
I can check that an unexpected request is genuine before I act on it.
1
2
3
4
5
Strongly disagreeStrongly agree
Question 8 of 14 Everyday security
Signing in to work systems rarely slows me down.
1
2
3
4
5
Strongly disagreeStrongly agree
Question 9 of 14 Everyday security
I know what to do if a work device of mine goes missing.
1
2
3
4
5
Strongly disagreeStrongly agree
Question 10 of 14 Everyday security
The security training I have had is about the work I actually do.
1
2
3
4
5
Strongly disagreeStrongly agree
Question 11 of 14 Habits and workarounds
How often do you use a password manager for your work accounts?
Always
Most of the time
Sometimes
Rarely
Never
We do not have one
Question 12 of 14 Habits and workarounds
Which of these have you seen happen where you work?
A login shared instead of access being requested
A work file sent to a personal address or personal cloud
An app used that nobody approved
A password written somewhere it can be seen
A security prompt turned off to get on with a job
None of these
Question 13 of 14 In your words
What is the one security rule or tool that most gets in the way of your work?
Question 14 of 14 Overall
Overall, how easy is it to work securely in your job?
Very easy
Easy
Neither easy nor hard
Hard
Very hard

The 14 cyber security survey questions

A cyber security questionnaire for employees is a short staff survey about how security works in their day: where they would report a suspicious message, which habits they keep and which rules slow them down. Nobody is graded. Open all fourteen as a free online questionnaire and rename the tools to yours.

Plain text, one question per line, with the answer scale.

About your work (2 questions)

Two facts first, so every result can be split by role and by access.

  1. Which of these is closest to the work you do?Choose oneSwap in your own function names.
  2. Which of these are a normal part of your working week?Tick all that applyRead payments and elevated access as their own group.

Reporting something suspicious (3 questions)

Knowing the route, having used it and what holds a report back.

  1. If a message arrived today that looked like an attempt to trick you, where would you send it?Choose onePut your real report button or address in the first two options.
  2. In the last 90 days, have you reported anything that looked suspicious?Choose one
  3. What would slow you down before reporting something?Tick all that applyEach answer names a fix someone can own.

Everyday security (5 questions)

Five statements on one agree scale, reported as one score.

  1. I know which of the things I work with count as sensitive.Strongly disagree to strongly agree
  2. I can check that an unexpected request is genuine before I act on it.Strongly disagree to strongly agreeCheck this one for people who approve payments.
  3. Signing in to work systems rarely slows me down.Strongly disagree to strongly agree
  4. I know what to do if a work device of mine goes missing.Strongly disagree to strongly agreeA low score calls for a one-page lost device card.
  5. The security training I have had is about the work I actually do.Strongly disagree to strongly agree

Habits and workarounds (2 questions)

One habit, then what people have seen around them.

  1. How often do you use a password manager for your work accounts?Choose one
  2. Which of these have you seen happen where you work?Tick all that applyAsks what people have seen, so nobody reports on themselves.

Their words, then the rating (2 questions)

One optional open answer, then the number you track each year.

  1. What is the one security rule or tool that most gets in the way of your work?Open answer, optional
  2. Overall, how easy is it to work securely in your job?Very easy to very hard

How to use the cyber security questionnaire

Send it to everyone who signs in to a work system, once a year, on its own date. Ask for no names, and merge any small group in question 1 before you share results.

Read question 13 first, because it names the tool or rule to fix. Then report three numbers: the share who picked a report button or a known channel in question 3, the share who agree or strongly agree across questions 6 to 10, and the Easy and Very easy share on question 14.

UK national guidance asks organizations to count how many people reported a suspicious message, and to keep blame out of it.[1] Question 5 shows what holds reports back.

Small message shapes converging into a funnel, several diverted away along dotted lines, the rest passing a gate and arriving stacked on a coral panel
Question 5 collects the reasons a report never gets sent.

Employee cyber security survey FAQ

What questions should a cyber security survey for employees ask?

Ask where staff would report a suspicious message, whether they have reported one and what would slow them down. Then cover sensitive data, checking requests, signing in, lost devices, training and password managers. Finish with one open answer and an overall rating.

How do you test employee cybersecurity knowledge?

A knowledge test has right answers and a pass mark per person. This questionnaire pairs with one. Questions 6 to 10 show whether people can use what they know on a busy day, and question 3 shows whether they know the reporting route.

How often should employees answer a cyber security questionnaire?

Once a year suits most teams, with the same wording each time so the numbers compare. Run it again after a big change, such as a new sign-in method or a new report button.

Related survey templates

After a phishing test, the phishing survey asks about that one message. Satisfaction with the IT team belongs in the IT survey questions. To hear how staff get on with their software and devices, send the technology survey. If question 10 scores low, the training needs assessment questions show which groups need what. Policies and codes of conduct have their own compliance survey. More are in the technology survey templates.

TechnologyPhishing SurveyWhen the subject is the last suspicious message people received, real or a test, and whether they reported it.14 questions, 4 min TechnologyIT Support SurveyWhen the subject is satisfaction with the IT service itself.12 questions, 3 min TechnologyTechnology SurveyWhen the subject is the software and devices staff use every day.14 questions, about 5 min TechnologyUser Experience SurveyWhen people route around one screen rather than one rule, and the thing to score is the interface itself.15 questions, 4 min TrainingTraining Needs Assessment SurveyBefore you commission the training, to find out which groups need what.14 questions, 4 to 5 min EmployeeEmployee Feedback SurveyWhen you want an open channel where anything can be raised, rather than answers on one named subject.14 questions, 4 min

Michael Hodge, survey methodology · Updated 2 October 2026 · How templates are reviewed

Sources (1)
  1. National Cyber Security Centre (UK). Phishing attacks: defending your organisation. ncsc.gov.uk

Ask the people who use the systems

Fourteen questions, about four minutes, and a reporting route you can fix.

Use this template