Does everyone in your organisation know how to report a suspicious message, call or login prompt? 1. Does everyone in your organisation know how to report a suspicious message, call or login prompt?
No agreed reporting channel exists. There is a channel, but not everyone knows it. There is a named channel, and staff have been told about it recently.
How does your organisation respond when someone reports a mistake, such as clicking a suspicious link? 2. How does your organisation respond when someone reports a mistake, such as clicking a suspicious link?
People are usually blamed or embarrassed. It depends on who made the mistake and who hears about it. Reports are consistently thanked and handled calmly.
Is multi-factor authentication (MFA) turned on for your main email and banking accounts? 3. Is multi-factor authentication (MFA) turned on for your main email and banking accounts?
Not turned on, or we do not know. Turned on for some accounts or some people. Turned on for all key email and banking accounts.
Do staff know never to share OTPs or approve login prompts they did not start? 4. Do staff know never to share OTPs or approve login prompts they did not start?
This has never been discussed. It has been mentioned informally. It is a clear, repeated rule that new staff also learn.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered