Does your business have a list of its important digital assets? 1. Does your business have a list of its important digital assets?
No, we have never written one down. We have a partial list, mostly of hardware, that is rarely updated. We have a list covering devices, accounts, data, domains and services, reviewed regularly.
Does every critical asset have a named owner? 2. Does every critical asset have a named owner?
Ownership is unclear or assumed to be 'IT' or 'everyone'. Some critical assets have owners, but several do not. Every critical asset has one accountable owner and a backup person.
Are your domain, main email admin and social media accounts controlled by the business? 3. Are your domain, main email admin and social media accounts controlled by the business?
We are not sure who controls some of them. Most are business-controlled, but one or two are tied to personal accounts. All are registered to business-controlled accounts with documented recovery options.
Do you know which accounts can reset access to your other systems? 4. Do you know which accounts can reset access to your other systems?
We have not thought about it. We know the main email matters, but have not mapped the others. We have identified our master-key accounts and protect them first, including with MFA.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered