Cyber Risk Assessment Questionnaire for Individuals & Organizations

Asset Management

1. Do you maintain an updated inventory of all hardware and software assets within the organization? ... No Partially Yes 2. Are critical assets identified and categorized based on their importance to the organization? ... No Partially Yes 3. Is there a process to monitor and update asset records when new devices or software are added or removed? ... No Partially Yes 4. Do you have a system in place to track and label assets by their ownership, location, and classification? ... No Partially Yes 5. Are digital and physical assets regularly audited to ensure they are properly documented? ... No Partially Yes

Governance

1. Are cybersecurity roles and responsibilities clearly defined and assigned within the organization? ... No Partially Yes 2. Do you have a formal cybersecurity policy that aligns with your business objectives? ... No Partially Yes 3. Is there a documented process for approving, managing, and reviewing cybersecurity policies and standards? ... No Partially Yes 4. Are risk management and cybersecurity integrated into the overall corporate governance framework? ... No Partially Yes 5. Is cybersecurity performance regularly reported to top management? ... No Partially Yes

Risk Assessment

1. Do you conduct regular risk assessments to identify potential threats and vulnerabilities to your organization? ... No Partially Yes 2. Are risk assessments updated after significant changes to your technology, processes, or environment? ... No Partially Yes 3. Do you evaluate the potential impact of identified risks on critical business operations? ... No Partially Yes

Supply Chain Risk Management

1. Do you assess the cybersecurity posture of your suppliers, partners, and vendors? ... No Partially Yes 2. Are there formal contracts or agreements outlining cybersecurity requirements for third parties? ... No Partially Yes 3. Do you have a contingency plan for cybersecurity incidents originating from third parties? ... No Partially Yes

Access Control

1. Are user accounts, including privileged accounts, regularly reviewed and managed? ... No Partially Yes 2. Is multi-factor authentication (MFA) enforced for accessing sensitive systems? ... No Partially Yes 3. Are access permissions based on the principle of least privilege? ... No Partially Yes

Data Security

1. Are data encryption practices in place for sensitive data both in transit and at rest? ... No Partially Yes 2. Is data classification conducted to identify and prioritize the protection of sensitive information? ... No Partially Yes 3. Are backup solutions implemented, and are backups regularly tested for integrity? ... No Partially Yes

Training & Awareness

1. Are cybersecurity awareness training programs conducted for all employees? ... No Partially Yes 2. Do you conduct regular security drills or simulated attacks to evaluate the staff's preparedness? ... No Partially Yes 3. Do you measure the effectiveness of training through assessments or tests? ... No Partially Yes

Anomalies and Events

1. Do you have systems in place to detect unusual behavior or anomalies in network traffic? ... No Partially Yes 2. Are alerts generated and escalated when unexpected activities are detected? ... No Partially Yes 3. Are logs analyzed to identify signs of unauthorized access or data breaches? ... No Partially Yes

Continuous Monitoring

1. Is there a dedicated team responsible for continuous monitoring of security events? ... No Partially Yes 2. Do you use automated tools to correlate and analyze log data from different sources? ... No Partially Yes 3. Are network and endpoint monitoring tools deployed for real-time threat detection? ... No Partially Yes

Log Monitoring

1. Are logs collected and analyzed from key systems, including servers, firewalls, and databases? ... No Partially Yes 2. Do you have a central repository for aggregating and storing log data? ... No Partially Yes 3. Is there a log review process for detecting unauthorized access or changes? ... No Partially Yes

Incident Management/Response Planning:

1. Is there a formal incident response plan (IRP) that is regularly updated & tested that defines how to handle security incidents? ... No Partially Yes 2. Are roles and responsibilities for incident response clearly assigned and documented? ... No Partially Yes 3. Are external stakeholders, including regulators and partners, informed of incidents? ... No Partially Yes

Incident Analysis:

1. Are root cause analyses conducted for each security incident? ... No Partially Yes 2. Is forensic evidence collected and preserved during incident investigations? ... No Partially Yes 3. Is there a process for reviewing the effectiveness of the incident response plan? ... No Partially Yes

Communication

1. Are there communication protocols for internal and external stakeholders in case of a cyber incident? ... No Partially Yes 2. Do you have a media management plan for cybersecurity incidents? ... No Partially Yes

Incident Mitigation:

1. Are containment strategies in place to identify, eradicate or minimize the impact of a security incident? ... No Partially Yes 2. Are security controls enhanced post-incident to prevent recurrence? ... No Partially Yes 3. Is mitigation documented and steps taken to remediate the issue? ... No Partially Yes

Incident Recovery Plan Execution

1. Is there a documented disaster recovery (DR) plan for critical systems and data? ... No Partially Yes 2. Are recovery point objectives (RPOs) and recovery time objectives (RTOs) clearly defined? ... No Partially Yes 3. Are critical assets prioritized in the recovery plan based on business impact? ... No Partially Yes

Backup and Restoration

1. Do you have an off-site backup strategy to ensure data availability in case of a breach? ... No Partially Yes 2. Are backups regularly tested to ensure they can be restored in a timely manner? ... No Partially Yes 3. Is there a formal process for validating the integrity of restored data? ... No Partially Yes

Incident Recovery Communication

1. Do you have protocols for internal and external communication post-recovery? ... No Partially Yes 2. Is there a communication strategy for reassuring clients and stakeholders after an incident? ... No Partially Yes 3. Do you provide summaries, actions taken and post-recovery report to senior management and relevant parties? ... No Partially Yes

Improvements

1. Are lessons learned from past incidents used to improve future response and recovery strategies? ... No Partially Yes 2. Do you perform regular audits of the recovery plan's effectiveness? ... No Partially Yes