Has your business completed a structured security posture assessment? 1. Has your business completed a structured security posture assessment?
No, we have never assessed our security as a whole. We have done an informal review once, without a consistent scale. We have a recorded baseline using a consistent scale, reviewed by a second person.
How do you treat a weak score in a high-impact area such as backup or incident response? 2. How do you treat a weak score in a high-impact area such as backup or incident response?
We look mainly at the overall score. We notice weak areas but do not always act on them first. High-impact gaps are flagged, owned and fixed first, whatever the total.
Are your maturity scores backed by evidence? 3. Are your maturity scores backed by evidence?
Scores are based on what we believe is happening. Some scores have evidence, but it is not checked. Scores of 3 or 4 are supported by light, dated evidence with no secrets in it.
How often do you reassess your security posture? 4. How often do you reassess your security posture?
Never, or only after a serious incident. Occasionally, without a fixed schedule. Every quarter and after major changes, with the trend reviewed by leadership.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered