Does your business have a written, time-bound plan for improving cybersecurity? 1. Does your business have a written, time-bound plan for improving cybersecurity?
No plan; we deal with issues as they come up. We have a list of ideas but no dates or owners. We have a dated plan with owners, reviewed regularly.
How do you decide which security gaps to fix first? 2. How do you decide which security gaps to fix first?
Whatever seems easiest or someone remembers. We try to focus on serious gaps, but without a clear method. We rank gaps by impact, exposure, urgency and dependencies and agree the order with the owner.
When a serious new risk is found, what happens? 3. When a serious new risk is found, what happens?
It waits until someone has time. It is mentioned to the owner, but there is no clear decision. It is escalated quickly, a decision is recorded and the plan is adjusted.
Can you show evidence that completed security actions are really working? 4. Can you show evidence that completed security actions are really working?
No, we assume they work once done. For some actions we have notes, but nothing is tested. Key actions are tested, such as restore tests and tabletop exercises, with dated records.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered