Know where the points are
Sign-in is worth 20 points, email 15, devices and backups 15, and website, connected apps, data, staff training and incident readiness 10 each. A question nobody has answered earns nothing, so answering is the quickest first step.
Do the quick, big fixes first
The fix plan puts the fixes that remove most risk for the least effort first. Turning on two-step sign-in for everyone usually takes minutes and is worth the most.
Answer as things really are
Partly is a fair answer and earns half the points. A score that matches the truth is more useful than a high one, and the evidence is kept with each answer.
Accept a risk only with a reason
If you decide not to fix something, mark it accepted and say why. It is recorded with your name and the date, so anyone can see the decision later.