Do you keep at least one backup copy that is offline or immutable? 1. Do you keep at least one backup copy that is offline or immutable?
No, or we are not sure Sometimes; a drive is disconnected occasionally or immutability is partly set up Yes, consistently, and someone is responsible for checking it
Have RPO and RTO been agreed for your critical services? 2. Have RPO and RTO been agreed for your critical services?
No targets have been discussed IT has an idea, but service owners have not agreed them Owners have agreed and written them down for each critical service
When did you last perform an actual restore test (not just a discussion)? 3. When did you last perform an actual restore test (not just a discussion)?
Never, or we do not know Once, more than a year ago, or only for a few files Within the last year for critical services, timed and recorded
Is there an agreed restoration order and continuity workaround for critical services? 4. Is there an agreed restoration order and continuity workaround for critical services?
No; we would decide on the day Some people know informally Yes, documented, shared with owners and practised in a tabletop
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered