Does your business have a written incident response playbook? 1. Does your business have a written incident response playbook?
No, we would work it out at the time. We have some notes, but people may not know where they are. We have a short written playbook that staff know about and that is reviewed regularly.
Do you have an incident contact card ready? 2. Do you have an incident contact card ready?
No, contacts are scattered across phones and emails. We have some contacts listed, but no backups or review date. We have a complete card with backups, official fraud routes and a review date, stored where it can be reached during an outage.
Do you know your reporting duties to authorities and affected people? 3. Do you know your reporting duties to authorities and affected people?
We have not looked into it. We have a general idea but have not verified it. We have checked current official sources with a qualified adviser and written the outcome into our playbook.
How often does your team practise or review incident response? 4. How often does your team practise or review incident response?
Never. Only after a real incident. We run a short tabletop exercise at least once a year and fix the gaps we find.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered