1. Does your organization have a security plan in place?
Yes, a comprehensive plan Partly/For certain assets No security plan in place
2. Who has access to the security plan?
IT Security Team/IT Professional(s) Third-party service provider No security plan in place
3. Does your organization have human resources (such as a Chief Information Security Officer (CISO), Chief Information Officer (CIO) etc) dedicated to enforcing and maintaining security policies?
Yes Managed by a third-party provider No
4. Does your organization have a bring-your-own-device (BYOD) policy?
Yes No Not sure
5. Does your organization have a password policy for all company-issued devices?
Yes No Not sure
6. Does your organization have two-factor authentication enforced on all online accounts?
Yes Some critical accounts No
7. Does your organization have account management and access controls in place?
Yes No Not sure
8. Does your organization give employees and contractors only enough access to do their jobs (i.e., least privilege necessary, “need to know”, etc.)?
Yes No Not sure
9. Does your organization have session controls in place?
Yes No Not sure
10. Does your organization already have security products/tools such as firewall, intrusion detection and encryption in place?
Yes, all of them Some of them Not sure
11. How often does your organization review audit logs?
Periodic automated/manual review Rarely Never Not sure
12. Does your organization have antivirus protection or endpoint protection?
Yes No Not sure
13. How often does your organization review the updates of antivirus protection?
Regularly check and update Sometimes check and update Never Not sure
14. Does your organization perform regular backups?
Yes No Not sure
15. Does your organization back up all data or only business-critical?
All data Only business-critical data No regular backups performed Not sure
16. How often does your organization test backups?
Regularly Rarely Never Not sure
17. Has your organization applied all applicable security patches?
Yes Some No Not sure
18. Does your organization have data segregation policies?
Yes No Not sure
19. Does your organization have encryption policies?
Yes No Not sure
20. Does your organization dispose of sensitive data or equipment that may have had sensitive data on it?
Yes No Not sure
21. Where are your servers located?
On-premises Cloud Hybrid
22. If you selected 'On-premises' or 'Hybrid' for Q21, does your organization have physical access controls in place?
Yes No Not sure Not applicable (cloud servers)
23. Are your organization’s employees and contractors trained in security best practices?
Yes Some No Not sure
24. What are your organization’s most important assets?
Customer data including Personally Identifiable Information (PII), Credit Card etc Organizational confidential data General data Not sure
25. What risks do you see in your organization’s assets?
Compromising data or unauthorized access Data disclosure Intentional & Accidental data leakage Data Exfiltration – moving data from protected to unprotected resources Resource unavailability for legitimate users All/Some of the above Not sure
26. What strategies does your organization use while mitigating the risks?
Using cloud services to store data Implementing security solutions and continuous monitoring (SIEM – Security Incident Event Management) Transferring risks to third parties All/Some of the above Not sure
27. What are the strengths of your organization’s current security system?
Security solutions and continuous monitoring (SIEM – Security Incident Event Management) SOC – Security Operations Centre Well-trained security team All/Some of the above Not sure
28. What are the security measures for your organization’s endpoint devices?
Establishing endpoint protection Mobile Device Management Systems Enterprise-level management solutions for endpoints Decentralized Device Management Combination/Combined solutions Not sure
29. How often does your organization assess the company website for security?
Regularly Sometimes Never Not sure
30. How often does your organization analyse access and error logs of the company website?
Regularly Sometimes Never Not sure
