Is my company at risk?

• Does this organization use cyber-related policies that are approved by the C-Level?
• Is there an Acceptable Use and/or other data related policies in effect?
• Are they well communicated, well understood and is it enforced?
• Is Training and Awareness a required part of annual certification for all employees?
• Do you have an Identity Lifecycle Management policy? Do HR and IT each have responsibilities in it?

Yes: 0 / 5

• Have the roles, responsibilities, expectations and measures for the resources been clearly communicated?
• Are the members of the IT staff engaged in cybersecurity trained and certified or have they learned mainly from "on the job training"?
• Are they confident in their ability to identify, protect, defend, respond and recover their environment?
• Are they familiar with the concepts of confidentiality, integrity and availability and how to apply them within their environment?
• Is there sufficient cross-coverage for each of the roles in compliance with the 80/20 rule?

Yes: 0 / 5

• Are users created according to the correct job roles and is access to folder shares governed by the use of functional groups?
• Are strong passwords (password complexity) in effect?
• Do passwords expire on a regular basis?
• Are all users, especially senior level individuals, covered under this policy?
• Are there limitations on and separation of Administrative and user ID's for elevated access to systems management?

Yes: 0 / 5

• Are there centrally managed and maintained inventories of computing assets that are maintained and audited? (servers, printers, phones, routers, laptops, tablets, etc.)
• Is there centralized purchase control of computing assets?
• Are there purchasing and laptop / desktop configuration standards based on job function?
• Do the configuration standards include encryption, anti-virus, firewalls and only approved software?
• Are the units configured to automatically apply patches?

Yes: 0 / 5

• Are the staff members able to enumerate the various types of threats to the organization — natural, unintentional and intentional — and do they have Incident Response and Disaster Recovery Plans in place?
• Are the plans practiced, reviewed and updated annually?
• Is there a documented emergency communications plan that does not rely on a single method, such as group e-mails only?
• Has the IT and Cybersecurity staff met with steering committee members or various stakeholders to identify both generic and specific threats to the organization? (Example: if the location is near an industrial plant that produces toxic chemicals, is there a plan to deal with Shelter in Place and remote access to data?)
• Has the organization recognized the risk to the safety of individuals, its mission, its assets and its reputation in that order, and do the policies and plans put priority on life and safety over all other concerns?

Yes: 0 / 5

• Does the organization have an individual or group tasked with providing cybersecurity training?
• Does the organization perform cybersecurity as part of onboarding?
• Does the organization either perform regular annual awareness training or require testing as part of annual HR certification?
• Does the organization communicate present threats in real-time to the end user community to alert them to be on the lookout for those threats?

Yes: 0 / 4

• Does the organization have an access control plan or policy?
• Is access control determined by job function?
• For file server shares and services delivered by a server, is access locked down based on the principle of least access? (only those that require access receive access)
• For file server shares and services delivered by a server, is access control by groups only and NOT by any individual user names?
• Is there some form of physical access control, key and/or electronic, between sections of the building, executive wing, wiring closets, server rooms?

Yes: 0 / 5

• Does the organization have a Data Retention Policy?
• Does that policy remain in effect throughout the backup and restore process?
• Is the policy enforced?

Yes: 0 / 3

• Has the organization identified sensitive data (e.g. IP, PII, PHI, PCI) and taken steps to ensure the data is protected by the principle of least access and is encrypted at rest and in motion where required?
• Has the organization implemented automated monitoring tools to look for transmittal of sensitive data such as SSNs or based on certain word filtering?
• Has the organization taken steps to ensure data is protected throughout its lifecycle, even during backup and restore operations, and is there a policy or procedure for identifying, communicating and disposing of the data at the end of its useful lifecycle?
• Has the organization taken steps to educate users that handle sensitive data on the concepts of clear desk and clear screen, and have they instituted secure scanning and printing areas or PIN to Print?
• Does the organization have a plan to identify the extent of the leakage, communicate the impact and provide relief to those affected such as credit monitoring for a specified period of years?

Yes: 0 / 5

• Does the organization have a network diagram that accurately conveys the topology of the network architecture with an internally managed IP address scheme?
• Does the organization or organization's representative configure, maintain, monitor and update their own routers and firewalls?
• My organization does NOT have any third party or vendor VPN connections into our systems; or if we do, they are isolated, monitored, and the third party is contractually obligated to conform to regular cybersecurity assessments.
• Is WPA2 Enterprise wireless security protocol in use to prevent unauthorized sharing of a WIFI password?
• Are there any IDS/IPS appliances in place and, if yes, do those appliances aggregate and alert with a low frequency of false positives, and has the system been tuned to minimize false negatives?

Yes: 0 / 5

• Does the organization automate the delivery of Critical and High patches to the end user devices?
• Does the organization regularly apply Critical and High severity patches to the servers?
• Does the organization test patches before they are released into the production environment?
• Does the organization have a communication plan for notification of patching and testing of servers?
• Does the organization log operational changes to the production environment?

Yes: 0 / 5

• Are backups online, nearline and offline with an air-gap?
• Have mock recoveries been performed? At the file level? At the server level?
• Is encryption, data retention and data security maintained throughout the cycle?
• Is there a Disaster Recovery Plan?
• Has a mock recovery been performed and, if yes, is continuous improvement part of the after-action of mock recovery operations?

Yes: 0 / 5

• Does the facility require badge access and, if yes, is it logged?
• Is access limited by time of day, day of week?
• Is human monitoring (guard or receptionist) and/or camera monitoring and a monitored alarm system in place?
• Does the facility use architectural security principles of lighting, bollards, deterrent landscaping?
• Do sensitive areas require elevated privileges or dual factor to enter?

Yes: 0 / 5

• Is there an incident response plan?
• Does the plan include real-time communications with staff, outside entities and the media as necessary and appropriate?
• Is there a help desk or incident logging application in use?
• Are Root Cause Analysis part of all after-actions?
• Are issues found and their resolutions part of continuous improvement?

Yes: 0 / 5