How does your business keep track of its cybersecurity risks? 1. How does your business keep track of its cybersecurity risks?
We do not track risks; we react when something goes wrong. We have an informal list or notes, but no consistent format. We keep a risk register with clear statements, ratings, owners, treatments and due dates.
How do you rate and compare risks? 2. How do you rate and compare risks?
We rely on gut feeling at the moment. We use ratings, but the scale changes or reasons are not recorded. We use one agreed likelihood and impact scale, with written reasons and assumptions.
How do you decide which risks to address first? 3. How do you decide which risks to address first?
We fix whatever is easiest or most visible. We look at scores, but critical items can get lost in the overall picture. We prioritise by business impact, exposure and dependencies, and escalate critical risks separately.
How often are risks and scorecard results reviewed? 4. How often are risks and scorecard results reviewed?
Never, or only after an incident. Occasionally, without set dates or follow-up on actions. On a set cycle, with owners reporting progress and residual risk updated.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered