First Name
Last Name
Address
Phone
*
Email
*
Organization Name:
*
Total employees in the Organization:
*
1-10
11-99
100-249
250+
What industry describes your Organization?
*
Banking
Biotechnology
Communications
Construction
Consulting
Education
Engineering
Entertainment
Finance
Government
Healthcare
Hospitality
Legal
Manufacturing
Not for Profit
Retail
Technology
Transportation
Other
By choosing 'Other' in the previous question, can you describe the Organization's industry?
How many locations/facilities does the Organization have?
One physical location
Two physical location
Three or more physical location
No elements found. Consider changing the search query.
List is empty.
What are the Organization's hours of operation?
*
Does the Organization employ and support remote employees?
Remote Employee
Remote Contractor
Remote Employee and Contractor
No remote workers
No elements found. Consider changing the search query.
List is empty.
Does the Organization perform background checks to examine and assess an employee/contractor's work and criminal history?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's employees required to sign a non-disclosure agreement (NDA)?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's employees required to sign the non-disclosure agreement (NDA) annually?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a formal process to manage the termination and/or transfer of employees?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a formal process to equip new employees and ensure the return of equipment from terminated/reassigned employees?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization staff wear ID badges?
Yes, with authorized access levels and types present on badge
Yes, with only employee name and/or company
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a Bring Your Own Device (BYOD) policy for personal devices (laptops, cellphones, ect.) utilizing organizational assets?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have effective physical access controls (e.g., door locks) in place to access the facilities?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are key areas within the Organization (e.g., server rooms, personnel files, etc.) protected from unauthorized access?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Which access control processes are in use within the Organization?
*
Manual lock with key
RFID access control locks
Keypad control locks
Unlocked door with gatekeeper (e.g., receptionist)
Other
Check all that apply.
By choosing 'Other' in the previous question, can you describe the other access control process(es)?
Does the Organization have a plan in place to manage access events or circumstances (e.g., a person with the server room key is sick)?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have policies and procedures in place to document repairs or modifications to physical access components?
Yes
No
No elements found. Consider changing the search query.
List is empty.
How are the Organization's physical access controls authorized?
*
Does the Organization use video surveillance technology?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Yes' in the previous question, can you describe your Organization's current video surveillance system?
*
Are the recording from the Organization's surveillance system stored on premises or in the cloud?
On premises
Cloud storage
Hybrid model
No elements found. Consider changing the search query.
List is empty.
Please describe the Organization's current network setup?
How many servers does the Organization have?
0
1-3
4-9
10
No elements found. Consider changing the search query.
List is empty.
What operating systems are the servers using?
*
Windows
Linux
UNIX
MacOS
Other
Check all that apply.
By choosing 'Other' in the previous question, can you name the other server operating system(s)?
Does the Organization collect and/or store sensitive data on any server?
Yes
No
No elements found. Consider changing the search query.
List is empty.
How many workstations (desktops) does the Organization have?
1-10
11-50
51-100
100+
No elements found. Consider changing the search query.
List is empty.
How many laptops does the Organization have?
1-10
11-50
51-100
100+
No elements found. Consider changing the search query.
List is empty.
What operating systems are the workstations and/or laptops using?
*
Windows 11
Windows 10
Older Windows (Windows 7/8, Vista, XP, 2000, NT, ect.)
MacOS
Linux
UNIX
Other
Check all that apply.
By choosing 'Other' in the previous question, can you name the other workstation/laptop operating system(s)?
Does the Organization collect and/or store sensitive data on any workstations/laptops?
Yes
No
No elements found. Consider changing the search query.
List is empty.
The Organization's corporate email provider is:
Self-hosted (Internal Exchange Server)
Hybrid cloud-hosted (Cloud Exchange, Office 365
Company Gmail/ Microsoft Ofiice/ Other Hosted Email Provider
Users utilized personal email for company business
No elements found. Consider changing the search query.
List is empty.
Does the Organization use a third party to administer your email system?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization use multi-factor authentication to protect email access?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a written access plan for email?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have an acceptable use policy for email?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a plan for creating new and removing terminated employees from email access?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Has the Organization recently performed an audit to optimize and validate email security features?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization use a system to monitor email for threats and unauthorized access?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization backup and archive the email system?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Yes' in the previous question, briefly describe any email backup policies and plans that the Organization currently has in place.
The Organization's telephone service is:
VoIP solution (Ring Central, Google Voice, etc.)
Hardline solution
Company-managed mobile phones
Personal mobile phones
No elements found. Consider changing the search query.
List is empty.
Are the Organization's telecommunication devices located in an access-restricted area?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Is the Organization's telecommunication system self-service?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Is there a member of the Organization responsible for the telecommunication system administration who can provision new users/devices and resolve basic support issues?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization utilize a wireless network?
Yes
No
No elements found. Consider changing the search query.
List is empty.
What type of encryption is used on the Organization's wireless network?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Other' in the previous question, please name the type of encryption that is used on the Organization's wireless network.
Is the wireless SSID (wireless network name) broadcasted?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a segmented guest wireless network?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have an Acceptable Use Policy banner present on the guest network?
Yes
No
No elements found. Consider changing the search query.
List is empty.
If known, please list the brands of wireless access devices (routers, access points, etc.) used.
Does the Organization utilize any of the following devices on the corporate network (Wired or Wireless):
Smart TVs
Personal Assistant Devices (Google Assistant Alexa, etc.)
Third Choice
Check all that apply.
Does the Organization use portable media devices? (e.g., CD/DVD drives, tablets, iPads, USB storage devices, etc.)
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a written security and acceptable use policy for Internet of Things (IoT) devices?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a person responsible for security policies and procedures?
Yes - Dedicated
Yes - A member of our staff handles it along with other responsibilites
Yes - We use an outside source
No
No elements found. Consider changing the search query.
List is empty.
How does the Organization communicate security updates to needed resources?
Does the Organization have an access control system to authorize and/or restrict user activity on your assets and network devices?
Yes
No
Not Applicable
No elements found. Consider changing the search query.
List is empty.
Services such as Active Directory are used to set, authorize, or restrict employee access.
Does the Organization segregate the network in a way that ensures data or services are available on a need-to-know basis?
Yes
No
Not Applicable
No elements found. Consider changing the search query.
List is empty.
Typical techniques include network segmentation and access control lists (ACL) to delineate access rights.
Does the Organization use multi-factor authentication for access to high-sensitive data?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a formal sexual harassment training policy for all employees?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a formal security awareness training policy for all employees?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a formal cyber security training policy for all employees?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a media destruction policy for used media (CD/DVD archives, floppy disks, audio or video tape, etc.) in place?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization track and audit the employees security training for completeness?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have an maintain a list of all physical devices in the company?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This include workstations, laptops, servers, networking devices, office equipment, etc.
Does the Organization have baseline configurations of IT systems established and maintained?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have an updated list of in-use company software such as office software suites, accounting packages, inventory management software, and software development tools?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a list of all cloud-based SaaS (Software as a Service) and collaborative file sharing tools (DropBox, Google Drive, etc.) in use?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a data flow map for internal and external communication?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Yes' for the previous question, is there an updated diagram available of the path that data travels into or out of your network, through which devices, and how the data is stored?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Is the Organization required by local, state, federal, or international agencies to comply with their specific cybersecurity regulations or policies?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This includes PCI, FINRA, HIPAA, GDPR, state banking department, etc.
Does the Organization have baseline configurations of IT systems established and maintained?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have an updated list of in-use company software such as office software suites, accounting packages, inventory management software, and software development tools?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a list of all cloud-based SaaS (Software as a Service) and collaborative file sharing tools (DropBox, Google Drive, etc.) in use?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a data flow map for internal and external communication?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Yes' for the previous question, is there an updated diagram available of the path that data travels into or out of your network, through which devices, and how the data is stored?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Is the Organization required by local, state, federal, or international agencies to comply with their specific cybersecurity regulations or policies?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This includes PCI, FINRA, HIPAA, GDPR, state banking department, etc.
Does the Organization have a Cybersecurity Roles and Responsibilities Policy for employees and third-party vendors?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a Written Information Security Policy (WISP)?
Yes
No
No elements found. Consider changing the search query.
List is empty.
A WISP outlines employee requirements or best practices regarding sensitive data.
Has the Organization performed a risk assessment?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This includes the Organization identifying and analyzing potential events that may negatively impact individuals, assets, and/or the environment and making judgments on the Organization's tolerability.
Does the Organization have a list of business products and services, prioritized from critical to low impact risks or vulnerabilities?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Have the Organization's management team, employees, and vendors agreed to policies for managing risk tolerance?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Has the Organization performed a Breach Impact Analysis?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This included categorizing threats and vulnerabilities with the potential to cause a security breach and giving a severity and priority based on the likelihood of occurrence?
Has the Organization completed a vulnerability assessment that identifies and documents weaknesses in your IT systems and network?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a breach response and disaster recovery plan in place?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Ares the Organization's breach response and disaster recovery plans tested periodically?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a backup plan for workstations and servers?
Yes, Backup Service (SaaS solution)
Yes, Local Backup (NAS, USB drives, DVD/Tape)
Yes, Hybrid (mix of SaaS and local devices)
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's backup plans maintained and tested periodically?
Yes
No
No elements found. Consider changing the search query.
List is empty.
For data systems, has the Organization determined uptime requirements to ensure business continuity?
Yes
No
No elements found. Consider changing the search query.
List is empty.
List the Organization's known cybersecurity assets:
Antivirus/Host Protection
Firewall - Physical Device
Firewall - Application Based
DNS Filtering
Data Exfiltration System
IDS/IPS System
Email Phishing Protection
Multifactor Authentication Access
Dedicated Cybersecurity Employee or Department
Check all that apply.
Has the Organization ever experienced a cyber breach/attack?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Yes' in the previous question, please describe the cyber breach/attack.
Has the Organization undergone breach remediation processes?
Yes
No
No elements found. Consider changing the search query.
List is empty.
By choosing 'Yes' in the previous question, please describe the details of the remediation.
Does the Organization have a System Development Life Cycle (SDLC) in place to manage software software/hardware development or configuration?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have an audit trail system in place to monitor network or system configuration changes?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a mandatory written data destruction policy?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's data protection processes being continuously improved?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Is Organizational data-at-rest protected?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This data includes Personally Identifiable Information (PII) stored on servers locally or in cloud storage.
Is Organizational data-in-transit protected?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This includes data transmitted within a private network, or externally to vendors and customers.
Does the Organization audit the protection technologies that are employed on a regular basis?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have a formal process to remove, transfer, or dispose of assets?
Yes
No
No elements found. Consider changing the search query.
List is empty.
This process includes electronic waste, archived materials, and printed materials.
Does the Organization implement protections against data leaks, such as exfiltration?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have systems in place to verify software, firmware, and information integrity?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's development and testing environment(s) separate from the production environment?
Yes
No
Not Applicable
No elements found. Consider changing the search query.
List is empty.
Has the Organization implemented a system or process to detect malicious code operating on the internal network?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization have IT mechanisms (e.g., fail-safe, load balancing, hot swap) in place to achieve network resilience requirements in normal and adverse situations?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's audit log records being determined, documented, implemented and reviewed in accordance with regulatory policy?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's employees required to complete cybersecurity awareness training and acknowledge their responsibilities?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's senior executives made aware of their roles and responsibilities regarding company data?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's administrators or privileged users, who have access sensitive data, required to acknowledge their increased roles and responsibilities?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization provide periodic security reminders or updates to its employees, contractors, or stakeholders?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Are the Organization's employees regularly sent simulated phishing email to gauge their response to a potential phishing attack?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Phishing is the act of sending a seemingly official email to maliciously harvest credentials.
Are the Organization's employees activities being monitored to detect potential cybersecurity events?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Has the Organization established and managed a baseline of network operations and expected data flows for users and systems?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Has the Organization tested the implemented network detection processes?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Penetration tests are used to exploit or discover network weaknesses, and phishing campaigns are used to test user behavior.
Is the Organization's physical network environment being monitored to detect potential cybersecurity events?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Does the Organization use a SIEM or other monitoring tools to aggregate and correlate event data from multiple sources and sensors to discern potential attack targets and methods?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Has the Organization established incident alert thresholds?
Yes
No
No elements found. Consider changing the search query.
List is empty.
These thresholds are based on network activity baselines. The Organization complies with the time frame to report an incident (successful or unsuccessful) to the appropriate authorities (internal or external).
Are the Organization's servers and workstations (desktop/laptop) being patched on a regular basis?
Yes
No
No elements found. Consider changing the search query.
List is empty.
Which patching method does the Organization use?
Manual
Automated software to install patches (i.e., an RMM tool)
Through a third party IT organization
Not currently doing patching