Has your business identified which services and data it most needs to protect? 1. Has your business identified which services and data it most needs to protect?
No, we have not thought about it in that way. We have a general idea, but it is not written down. We have a short written list of critical services and data, reviewed at least once a year.
How are logins to important systems managed? 2. How are logins to important systems managed?
Several people share the same logins, and old accounts are rarely removed. Most people have their own logins, but MFA and leaver removal are inconsistent. Everyone has their own login, MFA is on where available, and access is removed promptly when someone leaves.
How are changes to supplier or employee bank details handled? 3. How are changes to supplier or employee bank details handled?
They are updated as soon as a request arrives by email or WhatsApp. Someone sometimes checks, depending on who is handling it. Every change is confirmed by a call to a known number and approved by a second person.
Do you know which outside vendors or partners can access your systems or data? 4. Do you know which outside vendors or partners can access your systems or data?
We do not have a clear picture. We know the main ones, but access is not reviewed. We keep a simple list of vendor access and review it regularly, removing what is no longer needed.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered