Is MFA turned on for users of your critical cloud services? 1. Is MFA turned on for users of your critical cloud services?
No, or we are not sure. For admins or some users, but not everyone. For every user of critical services, and we check it regularly.
When an employee or contractor leaves, how is their cloud access handled? 2. When an employee or contractor leaves, how is their cloud access handled?
There is no set process. Access may continue for months. We disable main accounts but do not check files, shares or integrations. A same-day checklist covers accounts, file ownership, shared folders, automations and connected apps, including for contractors.
How often do you review sharing links, dormant accounts and connected apps? 3. How often do you review sharing links, dormant accounts and connected apps?
Never, or only after a problem. Occasionally, when someone remembers. On a regular schedule, with a named owner and a dated note of what changed.
Could you recover important SaaS data if it were deleted, corrupted or encrypted? 4. Could you recover important SaaS data if it were deleted, corrupted or encrypted?
We assume the provider or sync will handle it. We know some recovery options exist but have never tested them. We have an independent backup or export for critical data and have tested a restore.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered