Does your business understand what an outage of its critical services would cost? 1. Does your business understand what an outage of its critical services would cost?
We have not thought about it. We have a rough idea for some services, but nothing is written down. We have a written impact estimate, with assumptions, for our key services.
Have you agreed how quickly key services must be restored and how much data you can afford to lose? 2. Have you agreed how quickly key services must be restored and how much data you can afford to lose?
No, we would deal with it if it happened. We have informal expectations, but they are not tested against our backups. We have agreed RTO and RPO targets for key services and have checked that our backups can meet them.
If a key system went down tomorrow, how would essential work continue? 3. If a key system went down tomorrow, how would essential work continue?
We would probably stop work until it was fixed. People would improvise, but there is no agreed method or approver. We have a simple, approved manual workaround that staff know about.
Do you know your contractual and reporting obligations if an incident affects customer data or services? 4. Do you know your contractual and reporting obligations if an incident affects customer data or services?
We are not aware of any obligations. We know some customer contracts mention security, but have not reviewed them. We have reviewed key contracts and checked official guidance or advice on reporting expectations.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered