How does your business run security awareness? 1. How does your business run security awareness?
Rarely, or only after something goes wrong. Occasional sessions or messages without a clear focus. Planned campaigns on specific behaviours, with regular short messages and follow-up.
If you run simulations, what safeguards are in place? 2. If you run simulations, what safeguards are in place?
We run them informally without approval or clear rules. We get approval, but scope, data handling and support are not defined. Each simulation has written approval, defined scope, synthetic content, no credential collection and a support plan.
How do you measure human risk? 3. How do you measure human risk?
We do not measure it, or we only count clicks. We track some numbers but rarely compare over time. We track reporting rate, time to report and improvement across similar exercises, interpreted in context.
How are individual simulation results handled? 4. How are individual simulation results handled?
Names are shared publicly or used for discipline. Results are kept private, but nobody follows up. Results stay private, people get supportive coaching, and only team-level trends are shared.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered