When your business deals with a security risk, how is it usually handled? 1. When your business deals with a security risk, how is it usually handled?
We mostly rely on staff being careful. We combine awareness with some process or technical steps for a few risks. For our main risks we have people, process and technical layers, with a named owner for each.
When someone makes a security mistake or reports a near-miss, what typically happens? 2. When someone makes a security mistake or reports a near-miss, what typically happens?
People worry about being blamed, so issues are often kept quiet. Reports are welcome but there is no clear route or follow-up. Reports are thanked, there is a known contact, and the gap is fixed and shared without naming anyone.
Can you show simple evidence that your key security steps are happening? 3. Can you show simple evidence that your key security steps are happening?
No, we assume they happen. For one or two steps we have some records, but they are not reviewed. We keep light, dated records for key steps and someone reviews them regularly.
How does your business learn from security gaps and near-misses? 4. How does your business learn from security gaps and near-misses?
We fix things only after something serious happens. We discuss issues occasionally when someone remembers. We have a regular review where we pick and fix at least one gap.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered