1. Which are true of your information security management approach?

a. Budget and resources are allocated for comprehensive information security management

b. We currently have successful processes and measures, or are implementing them

c. Leadership doesn’t adequately understand or prioritize information security

d. When security incidents occur, it’s unclear who is responsible

2. Which are true of your business continuity and disaster recovery (BC/DR) position?

a. We have ensured our BC/DR plans will minimize cybersecurity incident impact to business operations

b. We are always able to access documented BC/DR plans

c. We periodically review and test our BC/DR plans

d. We do not know our risks for business continuity from cybersecurity incidents

3. Your security awareness and training is:

a. Annual, and mandatory for all employees

b. Customized by employee role

c. Incomplete: some employees lack required cybersecurity certifications

d. Annually reviewed and updated

4. Which are true of your information classification and asset management solution?

a. Some of our critical or sensitive information (e.g. PII) is not being classified correctly

b. Information is maintained throughout its lifecycle and conforms to relevant laws and regulations

c. Devices and information assets are identified and tracked based on a policy

d. We will know when critical confidential information leaks or is stolen

5. Which are true of your security and testing practices?

a. Security controls are periodically reviewed, tested, and audited

b. Our testing includes threat modeling, collecting threat intelligence, and risk analysis

c. Our testing includes vulnerability assessment and pen testing

d. Security audits are performed by an internal team

e. Security audits are performed by a third-party assessor

6. Which are true of your change and configuration management processes?

a. We have a comprehensive formal process for patch and change management

b. Some devices are not maintained by a formal configuration management scheme

7. Which security operations and response practices do you follow?

a. Logs and systems are continuously monitored

b. We have a dedicated security operation center that will identify security incidents

c. We have a security incident response team that handles all security incidents, including forensic analysis

8. Which are true of your technical and logical security controls?

a. Layered security defense systems are deployed across all networks

b. All access to sensitive data is controlled by an Identity and Access Management (IAM) system

c. We have sensitive data on endpoints that can’t be remote wiped in case of theft or loss

d. Data is protected at rest and while in transit across all systems and endpoints

e. There are endpoints in our network we can neither control nor monitor

9. Which are true of your physical and administrative controls?

a. We have physical controls (e.g., door locks) in the right places

b. Some administrative controls (e.g., restricted use warnings) are lacking or missing

c. We can confirm the security of all of our supply chains

10. Which are true of your application software development practices?

a. Not applicable - we do not develop our own software

b. We follow a Secure Development Lifecycle (SDLC)

c. Our SDLC is documented and accurately reflects our processes

d. We have a formal code review process

e. We use development tools that identify security vulnerabilities in our code

f. A security architect is involved in all software product designs