SELF ASSESSMENT by ESET

Do you have a business owner of cyber security in your management?

---

Is there dedicated staff to carry out cyber security duties?

---

Do you have available resources to cater for new challenges in cyber security?

Do you assess cyber security risks and does a summary document exist?

---

Have you defined remediation actions with budget assigned for realization?

---

Is cyber security policy and priorities well communicated throughout your organization?

Is there ongoing detection of malware and anomalies in systems and data?

---

Once incident has occurred, is there a written procedure to handle it?

---

Are you able to report incidents within 24 hours after occurrence?

---

Do you have business continuity and disaster recovery plans?

---

Do you perform regular backups and store business critical data separately?

Do you monitor risks associated with important suppliers and IT vendors?

---

Are cyber security requirements included in supplier contracts?

---

Do you check regularly if suppliers meet cyber security reguirements?

Do you follow security best practices throughout the delivery cycle of your IT systems (incl. evaluation of vulnerabilities, patch management and change/release management)?

---

Are devices maintained and configured centrally and provided with ownership?

---

Are groups of information services, users and systems clustered and separated in networks?

Do you follow identity and access rights management for users, roles, systems and physical locations?

---

When employee leaves, do you ban access to the company premises, equipment, software and data immediately?

---

Do you apply security measures for the use of private mobile equipment and for homeoffice?

---

Do you enforce strong passwords and use more steps to login to critical systems?

Is your management trained for cyber security and offers training to your employees regularly?

---

Do your employees recognize treats and are able to follow security guidelines (in case of phishing, online threats, found USB stick, not using public WiFi, etc.)

---

Once under attack, can you rely on your data to be secured and encrypted?

---

Are offices and facilities secured physically against malicious acts, accidents and disasters?