How are your security rules written down? 1. How are your security rules written down?
They are not written; people rely on memory or general advice. We have some rules or a template, but they are long, generic or rarely read. We have short, practical policies for key areas, in plain language staff understand.
Does each security policy or decision area have a named owner? 2. Does each security policy or decision area have a named owner?
No; it is unclear who decides most security matters. The owner or IT partner is assumed to handle everything. Each key area has one named, accountable owner, with roles mapped in a simple table.
How are policies communicated to staff? 3. How are policies communicated to staff?
They are not shared, or are stored somewhere few people know about. They are emailed once or shared at joining. They are explained in team meetings, shared in familiar channels and refreshed when they change.
How are policy reviews and exceptions handled? 4. How are policy reviews and exceptions handled?
Policies are never reviewed and exceptions happen informally. Policies are reviewed occasionally, and some exceptions are discussed but not recorded. Policies have review dates, and exceptions are recorded with a reason, approver, safeguard and expiry.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered