How often does your team receive security awareness? 1. How often does your team receive security awareness?
Rarely or never, or only during onboarding. Once or twice a year in a longer session. Short sessions or reminders at least monthly, built into normal meetings.
Is awareness content tailored to different roles? 2. Is awareness content tailored to different roles?
Everyone gets the same general content, if any. Some roles, such as accounts, get occasional specific guidance. Key roles get regular examples based on the decisions they actually make.
How visibly do owners and senior managers support security awareness? 3. How visibly do owners and senior managers support security awareness?
Leaders rarely take part and sometimes bypass the rules. Leaders support it in principle but seldom attend or set an example. Leaders attend, follow the same rules and openly share suspicious messages they receive.
When staff report a mistake or something suspicious, what usually happens? 4. When staff report a mistake or something suspicious, what usually happens?
There is no clear contact, or people fear blame and stay quiet. There is a contact, but responses are slow or sometimes critical. There is a named contact, reports are thanked promptly and lessons are shared without naming anyone.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered