How does your business decide which security issues to fix first? 1. How does your business decide which security issues to fix first?
We react to whatever seems urgent or whatever someone hears about. We roughly know our biggest worries but have not compared them. We consider threat, weakness and impact together and fix the highest risks first.
How is access to important systems such as accounts, banking and shared files given? 2. How is access to important systems such as accounts, banking and shared files given?
Most people have broad access or share common logins. Access is mostly role-based, but it is rarely reviewed and some logins are shared. Each person has their own login with only the access their role needs, reviewed regularly.
If a key file or system were wrongly changed or lost, could you recover it? 3. If a key file or system were wrongly changed or lost, could you recover it?
Probably not. There is often only one copy. We have some backups or version history, but they are not tested. Key files have version history or backups, and we have tested restoring them.
For your main risks, how many layers of protection do you have? 4. For your main risks, how many layers of protection do you have?
Usually one, such as a password or staff being careful. Two layers for some risks, but not consistently. People, process and technology layers for our main risks.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered