Campaign questionnaire fill-in

Do you have formal logging for all your digital assets and services your company has?

Yes, we use a specialised system to track those assets and every asset needs to be enrolled in the system before being used

Yes, we use an excel sheet to keep a record of our assets and we manually add/remove assets

We have a vague idea, but it's not enforced in a formal procedure

No, we don't keep a record of all our digital assets

Have you configured your internet routers or hardware firewall devices so that they block all other services from being advertised to the internet?

Yes

Are your internet routers or hardware firewalls configured to allow access to their configuration settings over the internet?

Yes, but we use 2FA (2 Factor Authentication) to log-in

Yes, we use simple authentication username and password

No, they don't provide access to configuration settings over the internet

How do you ensure patching of all known vulnerabilities in the software and hardware (firmware) you use?

We run regular patch updates and all of our applications and Operating Systems (OSs) are supported by the manufacturer that provides regular patches

We run regular patch updates on the applications and OS systems that allow it (we do have some End-of-Life applications and OS like Windows XP and Vista)

We don't run regular updates

Do you run automatic vulnerability scans?

Yes, every quarter

Yes, every 6 months

Yes, annually

Yes, more than once a year, no interval defined

Do you have any services enabled that are accessible externally from your internet routers or hardware firewall?

Yes, but all of them have a documented business case

Yes, but the need is not documented

No, our services are not accessible from the internet

Do you have automatic notifications when an account has had 5 or less incorrect log-in attempts?

Yes, for all users

Yes, for administrative accounts

Do you do a comprehensive security audit of these vendors?

Yes, our internal security team checks every possible vendor before becoming a supplier and we also do annual security reviews of all our vendors

Yes, we do a security check for business-critical vendors and an annual security review for them

Yes, we do an initial check for vendors for business-critical processes, but we don't review it after that

No, we have no procedure in place for doing vendor security review

Do you update high-risk security updates for OS and applications within 14 days of release?

Yes, for all our applications and OS

Yes, for high-risk applications

No, we don't run security updates within 14 days of release

Do you use encryption in your company?

Yes, for everything: devices are encrypted, data storage is encrypted, and our communication is encrypted

Yes, we encrypt our devices and our applications have standard encryption, but we don't do additional configurations

No, we use default applications and we don’t specifically activate device encryption

Phishing is a form of cyber-attack usually by email which aims to trick the user into installing malware or following a link and providing personal information. Do you provide separate training regarding phishing?

No, we do not provide any phishing training

Yes, we provide separate phishing training and we have a phishing platform installed that runs campaigns several times a year

Yes, we provide separate phishing training but we have no other measures in place

No, we include the information about phishing in the security awareness training

Did you analyse and create a remote working policy and other specific policies as response to COVID-19?

Yes, we defined policies (like remote working policy etc) and sent them to employees to read and acknowledge it using a proper acknowledgement system

Yes, we defined policies (like remote working policy etc) and trained all employees regarding the content of the policies and what to do when working from home

Yes, we defined policies (like remote working policy etc) and send a companywide email with the policies

No special policies were defined

Do you review who should have administrative access on a regular basis?

Yes, every 3 months

Yes, every 6 months

Yes, once a year

Yes, more than a year (no defined interval)

Does your password policy specify the minimum password length?

Yes, the password should be a 20 characters passphrase

Yes, the passwords should be at least 10 characters

Yes, the passwords should be at least 8 characters

Yes, the password should be less than 8 characters

No, our policy doesn't specify password length

Are all of your computers, laptops, tablets and mobile phones protected from malware?

Yes, we're using anti-malware software and we have enabled trusted sources (APP store or a list of approved applications) that our employees are allowed to install

Yes, we're using anti-malware software

No, we don't have anti-malware applications

Does your password policy specify the mandatory password composition from each category? (The categories are: lower case, upper case, symbols, and numbers)

Yes, the password must contain at least one element from all four categories

Yes, the password must contain at least one element from three categories

Yes, the password must contain at least one element from two categories

No, our policy doesn't specify anything about password composition

Do you have backups of all your server's data (business critical data)?

Yes, we have a very detailed procedure that includes full backups, incremental backups and clear SLA with stated RTO - Recovery Time Objective and RPO - Recovery Point objective

Yes, we have scheduled a backup, but no clear SLA

No, we don't have any backups for servers

Where do you store backups?

Backups are stored on a specialised backup system that is segregated by the rest of the network

Backups are stored on the same server or on another server, but the network is not segregated

We don't have a clear location for storing backups or we don't store backups

What is the best practice mentioned in your security policy regarding using passwords for multiple accounts?

Our policy specifies that the user must have a unique and different password for each account, to aid with that we provide a password manager that all our employees have to use

Users are advised to use different passwords for different accounts, but we do not provide a password manager

Use one password for personal accounts and one for corporate accounts

Use one password for all the accounts they own

No advice regarding the use of passwords for multiple accounts is offered

Do you regularly perform scans to identify unauthorized or rogue wireless access points?

Yes, we do in a quarterly basis

Yes, we do at least once a year

No, we never do

When you first receive a device (router or any hardware) or administrator accounts for applications do you change the default password?

Yes

How do you ensure that you know to change passwords after they have been compromised?

We have automatic dark web monitoring for our business emails and change all the accounts passwords that have been compromised

We have a mandatory password reset every 90 days

We have a mandatory password reset at least once a year

We have a mandatory password reset exceeding one year

We don't have automatic password reset nor monitoring for compromised accounts

The Information security policy document represents a set of rules and guidelines for people that work with IT assets. How detailed is your information security policy?

Our security policy is detailed, sets the policy objectives, it's updated at least once a year and formally communicated to all employees

Our security policy is detailed, sets the policy objectives, it's updated at least once a year, but it is not formally communicated to all employees

Our organisation has an information security policy, but is not updated once a year

Our organisation doesn't have a formal security policy

A security awareness session is a training to make employees aware of security procedures that are in place in the organisation. Do you provide regular security awareness training in your organisation?

Yes, the security awareness training is mandatory for all employees when they join and done every year after they join the company

Yes, the security awareness training is mandatory for all employees when they join and done every two or three years after they join the company

Yes, the security awareness training is mandatory for all employees only when they join the company

No, we do not provide a mandatory security awareness training

Can you only access laptops, computers and servers in your organisation (and the applications they contain) by entering a unique user name and password?

Yes, we don't use shared accounts

Individual computers use unique accounts, but we use shared accounts for administrative purposes

No, we don't have individual accounts for laptops and servers

Do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?

Yes, we have a procedure for account deactivation when the employee leaves and we also do at least one annual check

Yes, we have a procedure for account deactivation when the employee leaves and we also do some checks, though no time frame is set for this check and they don’t happen regularly

Yes, we have a procedure for account deactivation when the employee leaves but no other checks in place

Sometimes we deactivate accounts, but it's not a defined process so this activity is not done regularly

No, we don't have any process in place, and we don't usually deactivate accounts

Do you ensure that staff members only have the privileges that they need to do their current job? How do you ensure long term employees don't accumulate access rights?

Yes, we employ the least privilege principle and we do privilege access checks (though we don’t have a set time interval)

Yes, we employ the least privilege principle but we don't do privilege access checks

No, we do not have a process to check for access removal

Yes, we employ the least privilege principle and we do at least one privilege access check per year

Do you have automatic notifications when a user logs-in from a different location then the one he usually does? (Example: he usually logs-in in from US and now suddenly logs-in from China)

Yes, for all users

Yes, for administrative accounts

Do you have automatic notifications and monitoring for privilege escalation (example: when a command is run with “sudo” or administrative account)?

Yes, we monitor all commands issued with administrative privileges

Yes, only for business-critical servers

Network segregation is the separation of critical networks from the Internet and other internal, less sensitive networks.  A zero-day vulnerability is a vulnerability unknown to the producer of a software application or hardware device. Let's assume a hacker uses a zero-day vulnerability to hack your company. What are the most important security controls that you have set-up to stop the advancement of that intruder?

Network segregation and privilege escalation alerting

Network segregation

Privilege escalation alerting

We don't have any specific controls configured

Have you run a full backup restore exercise?

Yes regularly (we have a scheduled exercise at least once a year)

Yes, some time ago, but we don't have a regular activity

No, we have never run a full backup restore

Do you have a list with all your vendors that supply OS and applications?

Yes, we have a comprehensive list of all our vendors and applications (internal and external)

Yes, we have a partial list comprising of vendors for business-critical applications

No, we don't have a list

Do you have signed Service Level Agreements (SLAs) with vendors that supply your business with critical components including liability?

Yes, we have clear SLAs including liability, operating hours, service delivery terms etc

No, we don't have SLAs in place

What type of encryption do you apply for the protection of the Wi-Fi - SSID password, thus authentication and transmission over wireless network?

WPA3-Enterprise (192-bit encryption)

WPA3-Personal (128-bit encryption)

WPA2-PSK

WPA or WEP

Our Wi-Fi is not password protected