How is MFA used on your critical business accounts? 1. How is MFA used on your critical business accounts?
MFA is off or we do not know. MFA is on for some accounts, such as email, but not all critical ones. MFA is on for all critical accounts, with the status reviewed regularly.
How are passwords for business accounts stored? 2. How are passwords for business accounts stored?
Notebooks, sticky notes, chats or reused personal passwords. Some people use a password manager, but there is no agreed tool. Everyone uses an approved password manager with unique passwords and a protected master passphrase.
Do staff have individual logins with only the access they need? 3. Do staff have individual logins with only the access they need?
Several systems use shared logins and most people have broad access. Most systems have individual logins, but access is rarely reviewed. Each person has their own login, admin rights are limited and access is reviewed regularly.
When someone leaves or changes role, how quickly is their access updated? 4. When someone leaves or changes role, how quickly is their access updated?
Often weeks later, or not at all. Within a few days, but some accounts get missed. On the same day, using a simple checklist of all systems.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered