Questionnaire

Cyber Risk Self Assessment Tool

Overall Profile

Section 1 of 6

In what industry does the company operate?

 

Where are the company Head Offices located?

 

Has the company locations in multiple States?

 

Does the third-party companies has access to the offices?

 

What is the annual turnover? (million euro)

 

What best describes the global headcount of your organization?

 

How much personal identifiable information (PII) does your organization process?

 

How much health-related information does your organization process?

 

How much financial data does your organization process?

 

Identify (1)

Section 2 of 6

Are physical devices and systems within the organization inventoried?

 

Are software platforms and applications within the organization inventoried?

 

Are organizational communication and data flows mapped?

 

Are resources prioritized based on their classification, criticality, and business value?

 

Are cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) established?

 

 

Identify (2)

Section 3 of 6

Which of the following are identified and communicated?

 

Are the policies, procedures, and processes to manage and monitor the organization’s regulatory understood and used for the management of cybersecurity risk?

 

Does the company include the IT risk inherent in the organization's operations, assets and individuals? Which of the following are identified and documented?

 

Are the organization’s priorities, constraints, risk tolerances, and assumptions established and used to support operational risk decisions?

 

 

Protect

Section 4 of 6

Is the access to assets and associated facilities limited to authorized users, processes, or devices, and to authorized activities and transactions?

 

Are the organization's personnel and partners provided cybersecurity awareness education and adequately trained to perform their information security-related duties and responsibilities consistent with related policies, procedures, and agreements?

 

Are information and records (data) managed consistent with the organization's risk strategy to protect the confidentiality, integrity, and availability of information?

 

Are security policies, processes and procedures constantly implemented and updated to manage the security of information systems and assets?

 

Is maintenance and repairs of industrial control and information system components performed consistent with policies and procedures?

 

Are technical security solutions managed to ensure the security and resilience of systems and assets, consistent with related policies, procedures, and agreement?

 

 

Detect

Section 5 of 6

Is anomalous activity detected in a timely manner and the potential impact of events understood?

 

Are the information system and assets monitored at discrete intervals to identify cybersecurity events and verify the effectiveness of protective measures?

 

Are detection processes and procedures maintained and tested to ensure timely and adequate awareness of anomalous events?

 

 

Resilience

Section 6 of 6

There is a response plan and this is performed during or after an accident:

 

If there is a response plan:

 

Is analysis conducted to ensure adequate response and support recovery activities?

 

Are activities performed to prevent expansion of an event, mitigate its effects, and eradicate the incident?

 

There is a recovery plan and this is performed during or after an accident:

 

If there is a recovery plan: