Cyber Security Health Check

Please review the questions below to complete your cyber security risk assessment. If you are unsure of any questions you can select unsure and update your answers at a later date.

Cyber Security Health Check

Cyber Security Overview

0 of 6 complete

1 Do you have a company wide cyber security policy?

Yes

Unsure

2 Do you have any cyber security awareness posters around the office?

Yes

Unsure

3 Do you have an internal person and/or external company who is responsible for your organisations cyber security?

Yes

Unsure

4 How often is cyber security discussed at a management / board level?

Often

Rarely

Never

5 Do you currently have cyber insurance?

Yes

Unsure

6 Has your organisation ever experienced a cyber security incident?

Yes

Unsure

Information Security

0 of 4 complete

1 Do you have a formal Information Security (IS) document which lists confidential information to your organisation and how this information should be handled by staff?

Yes

Unsure

2 Do you have a simple process to audit 3rd parties for their cyber security resilience before sharing confidential information?

Yes

Unsure

3 Have you identified mission critical information and services that would cause significant disruption to your business, if interrupted or lost?

Yes

Unsure

4 Do you have an inventory of all devices / phones / computers and details of what confidential information each holds?

Yes

Unsure

Authentication & Passwords

0 of 4 complete

1 If you use cloud storage for any documents (eg: Dropbox, Google Drive), do you have two-factor authentication enabled?

Yes

Unsure

2 If you use a cloud based CRM, do you have two-factor enabled?

Yes

Unsure

3 Do you use a password manager?

Yes

Unsure

4 Do you enforce the use of strong and unique passwords?

Yes

Unsure

Staff Security Awareness

0 of 3 complete

1 Are you confident that staff are cyber aware and understand cyber risks to the organisation?

Yes

Unsure

2 Would staff know how to identify a spear phishing email?

Yes

Unsure

3 Have staff ever completed cyber security training?

Yes

Unsure

Network & Wi-Fi Security

0 of 6 complete

1 Do you have network segmentation implemented to separate critical areas from non-critical areas? (such as BYOD Wi-Fi networks)

Yes

Unsure

2 Do you regularly change access details for all networking devices?

Yes

Unsure

3 Do you monitor network traffic for abnormal activity?

Yes

Unsure

4 Do you store access and activity logs for network devices?

Yes

Unsure

5 Have you performed a penetration test in the past 18 months?

Yes

Unsure

6 Do you have any intrusion detection / prevention systems in place?

Yes

Unsure

Email Security

0 of 4 complete

1 Do you enforce two-factor for webmail access?

Yes

Unsure

2 Do you have SPAM and anti-virus filtering enabled for inbound email?

Yes

Unsure

3 Do you have an acceptable email use policy?

Yes

Unsure

4 Do you have outgoing policies in place to ensure large volumes of data (eg. excel, zip files) can not be sent?

Yes

Unsure

Software & Application Security

0 of 4 complete

1 Do you have restrictions to limit what type of applications an employee can run on their company computers?

Yes

Unsure

2 Do you have an internal or external provider regularly applying software patches / system updates?

Yes

Unsure

3 Have you disabled default macro functions in Microsoft Office applications? (eg: Excel / Word / Powerpoint)

Yes

Unsure

4 Have you investigated application specific settings to harden default security settings? (eg. web browsers and operating systems)

Yes

Unsure

Internet Use & Browser Security

0 of 2 complete

1 Do you have website filters in place to restrict access to websites that may be harmful to your organisation? (eg: torrents / gambling)

Yes

Unsure

2 Do you have an acceptable internet use policy?

Yes

Unsure

Website Security

0 of 4 complete

1 Do you have an offline copy of critical domain name details? (eg: renewal dates / domain keys)

Yes

Unsure

2 Do you have an offline copy of critical website hosting details? (eg: server location / FTP access details)

Yes

Unsure

3 Do you complete regular malware scans of your website?

Yes

Unsure

4 Is user data collected from your website stored securely?

Yes

Unsure

Device Security

0 of 3 complete

1 Do you have encryption enabled on all devices, and a policy to ensure that all new devices have encryption enabled by default.

Yes

Unsure

2 Do you have a formal process when disposing of old computers or mobile phones?

Yes

Unsure

3 Do you centralise management and configuration of all computers?

Yes

Unsure

Endpoint Protection

0 of 2 complete

1 Do you have an active anti-virus service?

Yes

Unsure

2 Is the anti-virus centrally managed and are updates applied regularly?

Yes

Unsure

Removable Media

0 of 2 complete

1 Do you have a policy or process around how removable media (eg: USB drives) should be used and what information can be copied onto these drives?

Yes

Unsure

2 Has autoplay for removable media been disabled on work machines?

Yes

Unsure

Remote Working

0 of 2 complete

1 Do you have a VPN setup for staff to connect to the office remotely?

Yes

Unsure

2 Do you have guidelines for staff to use their personal computers to access your organisations systems and data?

Yes

Unsure

Disaster Recovery

0 of 3 complete

1 Do you have a recovery plan of who is responsible for what and who has access to recovery data?

Yes

Unsure

2 Do you perform regular backups of computers and servers?

Yes

Unsure

3 Do you test the integrity of backups on a regular basis?

Yes

Unsure

Incident Response

0 of 5 complete

1 Are you aware of what notification is required to send to customers should you experience a breach?

Yes

Unsure

2 Do you maintain computer / server logs to investigate a breach should one occur?

Yes

Unsure

3 Do you have a basic plan of action (incident response plan) which outlines roles and responsibilities should you experience a cyber incident?

Yes

Unsure

4 Have you specifically investigated your legal risk relating to cyber security?

Yes

Unsure

5 Have you specifically investigated your regulatory obligations with relation to cyber security?

Yes

Unsure

Progress

Cyber Security Health Check