Please answer these simple 15 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your organization include cybersecurity risk management activities and outcomes in enterprise risk management processes? NIST Standard GV.RM-03

Yes

Cybersecurity risk management activities and outcomes are included in enterprise risk management processes

Does your organization establish lines of communication across the organization for cybersecurity risks, including from suppliers and third parties? NIST Standard GV.RM-05

Yes

Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties

Does your organization establish, communicate, and enforce policy for managing cybersecurity risks based on context, strategy, and priorities? NIST Standard GV.PO-01

Yes

Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced

Does your organization establish, communicate, understand, and enforce roles, responsibilities, and authorities related to cybersecurity risk management? NIST Standard GV.RR-02

Yes

Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

Does your organization review cybersecurity risk management strategy outcomes to inform and adjust strategy and direction? NIST Standard GV.OV-01

Yes

Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction

Does your organization identify and record internal and external threats to the organization? NIST Standard ID.RA-03

Yes

Internal and external threats to the organization are identified and recorded

Does your organization use threats, vulnerabilities, likelihoods, and impacts to understand inherent risk and inform risk response prioritization? NIST Standard ID.RA-05

Yes

Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

Does your organization manage, assess for risk impact, record, and track changes and exceptions? NIST Standard ID.RA-07

Yes

Changes and exceptions are managed, assessed for risk impact, prioritized, communicated, and tracked

Does your organization define, manage, enforce, and review access permissions, entitlements, and authorizations, incorporating least privilege and separation of duties? NIST Standard PR.AA-05

Yes

Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, reviewed, and incorporate the principles of least privilege and separation of duties

Does your organization manage, monitor, and enforce physical access to assets commensurate with risk? NIST Standard PR.AA-06

Yes

Physical access to assets is managed, monitored, and enforced commensurate with risk

Does your organization protect the confidentiality, integrity, and availability of data-at-rest? NIST Standard PR.DS-01

Yes

The confidentiality, integrity, and availability of data-at-rest are protected

Does your organization protect the confidentiality, integrity, and availability of data-in-transit? NIST Standard PR.DS-02

Yes

The confidentiality, integrity, and availability of data-in-transit are protected

Does your organization generate and make log records available for continuous monitoring? NIST Standard PR.PS-04

Yes

Log records are created, protected, maintained, and analyzed

Does your organization prevent installation and execution of unauthorized software? NIST Standard PR.PS-05

Yes

Installation and execution of unauthorized software are prevented

Does your organization perform analysis to establish what has taken place during an incident and the root cause? NIST Standard RS.AN-03

Yes

Analysis is performed to establish what has taken place during an incident and the root cause of the incident