Please answer these simple 10 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your enterprise have a system to automate detection of identity risks, such as over-privileged accounts, to support cybersecurity risk assessments? NYDFS Standard 500.2(b)

Yes

Cybersecurity Program: Each Covered Entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of information systems, based on a risk assessment.

Is there an assigned resource to oversee and implement the cybersecurity program, including access control policies? NYDFS Standard 500.4(a)

Yes

Chief Information Security Officer: Each Covered Entity shall designate a CISO responsible for overseeing and implementing the cybersecurity program and enforcing its cybersecurity policy.

Does your organization have policies and practices to allocate appropriate access to information systems containing sensitive data? NYDFS Standard 500.7

Yes

Access Privileges: Limit user access privileges to information systems that provide access to nonpublic information to only those needed to perform job functions.

Does your organization have a quantified access request/approval process for systems handling nonpublic information? NYDFS Standard 500.7

Yes

Access Privileges: Limit user access privileges to information systems that provide access to nonpublic information to only those needed to perform job functions.

Does your organization have procedures to address and report cybersecurity incidents within 72 hours? NYDFS Standard 500.17(a)

Yes

Notices to Superintendent: Notify the superintendent within 72 hours of a cybersecurity event that has a reasonable likelihood of materially harming normal operations or requires reporting to other authorities.

Does your enterprise have automated methods to review access controls for systems involved in business continuity or disaster recovery? NYDFS Standard 500.16

Yes

Business Continuity and Disaster Recovery: Establish a plan to ensure availability and functionality of information systems during disruptions, including access control reviews.

Does your enterprise perform periodic evaluations of access controls for systems containing nonpublic information? NYDFS Standard 500.18

Yes

Audit Trail: Maintain systems to reconstruct material financial transactions and audit cybersecurity events, with records maintained for at least three years.

Does your enterprise have the ability to review group/role-based access to systems handling nonpublic information? NYDFS Standard 500.7

Yes

Access Privileges: Limit user access privileges to information systems that provide access to nonpublic information to only those needed to perform job functions.

Does your organization ensure individual access to nonpublic information is granted, reviewed, and revoked appropriately? NYDFS Standard 500.7

Yes

Access Privileges: Limit user access privileges to information systems that provide access to nonpublic information to only those needed to perform job functions.

Does your organization have an established method to generate compliance reports for NYDFS annual certification? NYDFS Standard 500.17(b)

Yes

Notices to Superintendent: Submit an annual certification of material compliance or acknowledgment of noncompliance by April 15.

Full Name *

Email *

Phone *

Business *

GRC Partner Email(Optional)