How well do you know which systems need updates and security attention? 1. How well do you know which systems need updates and security attention?
We do not keep a list of our systems. We have a partial list that is rarely updated. We keep a current asset list, including internet-facing systems, and review it regularly.
How are security weaknesses tracked once they are found? 2. How are security weaknesses tracked once they are found?
They are not tracked; we fix things when we remember. Someone keeps notes, but without owners or due dates. We keep a register with an owner, due date and status for each finding.
How do you decide which weaknesses to fix first? 3. How do you decide which weaknesses to fix first?
There is no clear basis; we fix whatever is easiest. We follow the severity label only. We consider severity, exposure, business impact and existing safeguards.
How are security tests and fixes controlled? 4. How are security tests and fixes controlled?
Anyone may scan or test, and fixes are not checked afterwards. Tests are usually approved, but fixes are rarely verified. Tests need written scope and approval, and fixes are verified and recorded.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered