Please answer these simple 15 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your organization define and allocate information security roles and responsibilities according to organizational needs? ISO Standard 5.2

Yes

Information security roles and responsibilities: Control Information security roles and responsibilities shall be defined and allocated according to the organization needs.

Does your organization collect and analyze information relating to information security threats to produce threat intelligence? ISO Standard 5.7

Yes

Threat intelligence: Information relating to information security threats shall be collected and analysed to produce threat intelligence.

Does your organization develop and maintain an inventory of information and other associated assets, including owners? ISO Standard 5.9

Yes

Inventory of information and other associated assets: An inventory of information and other associated assets, including owners, shall be developed and maintained.

Does your organization identify, document, and implement rules for the acceptable use and procedures for handling information and other associated assets? ISO Standard 5.1

Yes

Acceptable use of information and other associated assets: Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.

Does your organization establish and implement rules to control physical and logical access to information and other associated assets based on business and information security requirements? ISO Standard 5.15

Yes

Access control: Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements

IDoes your organization provision, review, modify, and remove access rights to information and other associated assets in accordance with the organization’s topic-specific policy on and rules for access control? SO Standard 5.18

Yes

Access Rights: Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control.

Does your organization establish processes for acquisition, use, management, and exit from cloud services in accordance with information security requirements? ISO Standard 5.23

Yes

Information security for use of cloud services: Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements.

Does your organization assess information security events and decide if they are to be categorized as information security incidents? ISO Standard 5.25

Yes

Assessment and decision on information security events: The organization shall assess information security events and decide if they are to be categorized as information security incidents.

Does your organization identify and meet requirements regarding the preservation of privacy and protection of PII according to applicable laws, regulations, and contractual requirements? ISO Standard 5.34

Yes

Privacy and protection of personal identifiable information (PII): The organization shall identify and meet the requirements regarding the preservation of privacy and PII according to applicable laws and regulations and contractual requirements.

Does your organization regularly review compliance with the information security policy, topic-specific policies, rules, and standards? ISO Standard 5.36

Yes

Compliance with policies, rules and standards for information security: Compliance with the organization’s information security policy, topic-specific policies, rules and standards shall be regularly reviewed.

Does your organization restrict and manage the allocation and use of privileged access rights? ISO Standard 8.2

Yes

Privileged access rights: The allocation and use of privileged access rights shall be restricted and managed.

Does your organization restrict access to information and other associated assets in accordance with the established topic-specific policy on access control? ISO Standard 8.3

Yes

Information access restriction: Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.

Does your organization appropriately manage read and write access to source code, development tools, and software libraries? ISO Standard 8.4

Yes

Access to source code: Read and write access to source code, development tools and software libraries shall be appropriately managed.

Does your organization obtain information about technical vulnerabilities of information systems, evaluate exposure, and take appropriate measures? ISO Standard 8.8

Yes

Management of technical vulnerabilities: Information about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken.

Does your organization segregate groups of information services, users, and information systems in the organization’s networks? ISO Standard 8.22

Yes

Segregation of networks: Groups of information services, users and information systems shall be segregated in the organization’s networks.