Security practices Choose the closest answer for each. “Not sure” is useful information too.
1. Devices and systems inventory Do you maintain an up-to-date inventory of organization devices, cloud services, and business-critical systems?
2. Email and cloud access Is multifactor authentication (MFA) required for email and cloud services?
3. Administrator accounts Are administrator accounts protected by MFA and kept separate from everyday user accounts?
4. Endpoint protection Do all computers and servers have centrally managed endpoint protection with alert monitoring?
5. Updates and vulnerabilities Are operating systems and business applications routinely updated, with a process for urgent security fixes?
6. Backups and recovery Are important systems and data backed up, with protected copies and regular restore tests?
7. Sensitive data protection Do you know where sensitive business data is stored, who can access it, and how it is protected in transit and at rest?
8. Service providers and vendors Are important technology providers reviewed for security and privacy risks before access to systems or sensitive data is granted?
9. Email threat protection Do you use email filtering and have SPF, DKIM, and DMARC configured for your organization’s domain?
10. User access Are access rights reviewed regularly, and promptly removed when someone changes roles or leaves?
11. Staff awareness Do staff receive regular security awareness training and know how to report suspicious activity?
12. Incident response Is there a written incident response plan, with assigned contacts and a recent exercise or walkthrough?
13. Security monitoring Are important security alerts and logs reviewed, with a clear process for responding to suspicious activity?
