Cybersecurity Questionnaire

  • Cybersecurity Questionnaire

  • For each question, please answer Yes or No. For multi-part questions, if the answer to any part is 'No' please answer No. Please be as descriptive as possible and provide relevant documentation where available. These questions are designed to provide an overview of functional areas that may require extra attention and are not intended to provide a comprehensive evaluation of your cybersecurity program.


  •
  • Format: (000) 000-0000.
    • ALERT VERIFICATION AND ESCALATION PROCEDURE 
    • Is there a process in place for responding to alerts generated?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • ASSET MANAGEMENT 
    • Does the company have a documented inventory of its information systems and assets?*
    • Has each IT service been classified based on sensitivity and criticality?*
    • Is there a policy/process for managing the hardware lifecycle, from purchase through proper disposal?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • AWARENESS TRAINING 
    • Is there an ongoing cybersecurity training program in place?*
    • Are phishing campaigns conducted regularly?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • CHANGE MANAGEMENT 
    • Is there a documented change management process in place?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • CYBER INCIDENT 
    • Has there been a cyber incident that has resulted in financial or data loss in the last 3 years?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • CYBER INSURANCE 
    • Do you currently have Cyber Insurance? If so, please describe the policy type and coverages.*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • DATA BACKUP 
    • Are test restores from backup periodically performed?*
    • Are all servers and/or data (stored or hosted) protected by backups?*
    • Are the backups stored in more than one physical location, including an offsite?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • DISC ENCRYPTION 
    • Is full disk encryption in place for servers and endpoints?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • EMAIL SECURITY GATEWAY 
    • Is there a solution in place providing email encryption when sending sensitive data?*
    • Is there a dedicated email spam filter in place?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • IDENTITY AND ACCESS MANAGEMENT 
    • Are all login identity accounts controlled by a documented policy/process that covers onboarding, off-boarding, permission changes, and periodic audits?*
    • Do you utilize any accounts that are shared across multiple users?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • INCIDENT RESPONSE PLANNING 
    • Is there a documented Incident Response plan?*
    • Are incident roles and responsibilities clearly defined and documented?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • IT RECOVERY PLAN 
    • Is there a documented step-by-step guide (runbook) for restoring services after an incident/outage?*
    • Have recovery time and recovery point objectives been defined?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • LOG MANAGEMENT 
    • Is there a SIEM or other audit log aggregation/retention method in place?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • MOBILE DEVICE MANAGEMENT 
    • Is there a mobile device management process/policy that prevents unauthorized access to company data?**
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • MULTI-FACTOR AUTHENTICATION (MFA) 
    • Are all network identities protected by MFA?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • NETWORK SECURITY 
    • Does the company have a network diagram with information flows?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • NEXT GEN AV/EDR 
    • Is there a Next Gen (Behavior based or AI enabled) AV/EDR solution in place on every company endpoint?**
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • NEXT GENERATION FIREWALL 
    • Is there a next generation firewall in place with intrusion detection services (IDS) and intrusion prevention services (IPS), content filtering, etc?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • PATCH MANAGEMENT 
    • Is there a process/procedure in place for patching computer devices and network equipment?* *
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • PENETRATION TESTING 
    • Has a penetration test been performed in the past 12 months? If so, please provide documentation.*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • PHYSICAL ACCESS 
    • Is physical access to critical systems controlled with auditing capabilities?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • PROTECTIVE DNS 
    • Is DNS filtering in place?**
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • REMOTE ACCESS 
    • Is there a policy/process in place for allowing remote access to company resources?*
    • Is remote access to company resources protected by MFA?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • TABLETOP EXERCISES 
    • Is the incident response plan tested (i.e. tabletop exercise, failover to backup environment) at least annually?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • VENDOR MANAGEMENT 
    • Is there a policy/process in place for vetting the cybersecurity posture of a vendor/third-party before engaging with them?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • VULNERABILITY MANAGEMENT 
    • Is there a vulnerability management program in place?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • WEB SECURITY GATEWAY 
    • Is there a web security gateway in place?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • 24/7 MANAGED SOC (SECURITY OPERATIONS CENTER) 
    • Is there a 24/7 SOC in place monitoring for malicious activity?*
    • Browse Files
      Drag and drop files here
      Choose a file
      Cancelof
    • Should be Empty: