How are changes to bank details, delivery addresses or payment instructions verified? 1. How are changes to bank details, delivery addresses or payment instructions verified?
We act on the email or message if it looks genuine. Some staff call to check, but there is no fixed rule. Always by a call to a known number and a second approval, with a short record kept.
How does your business share files with customers, suppliers and staff? 2. How does your business share files with customers, suppliers and staff?
Whatever is convenient: personal email, personal drives or open links. Mostly an approved platform, but permissions are rarely checked. An approved platform with named access, least privilege and periodic reviews of external sharing.
Are browsers and devices used for business work kept up to date? 3. Are browsers and devices used for business work kept up to date?
Updates are often postponed or ignored. Updates happen eventually, but nobody checks. Automatic updates are on and someone checks periodically that devices are current.
Do staff have clear guidance on public Wi-Fi and working while travelling? 4. Do staff have clear guidance on public Wi-Fi and working while travelling?
No guidance exists. Some informal advice, but it is not written down. Short written guidance: use a mobile hotspot or approved VPN, and no payments or admin on public Wi-Fi.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered