Cyber Risk Assessment

1. Has your organisation formally assigned responsibility for cybersecurity?

2. Do you maintain documented cybersecurity policies and review them regularly?

3. Do you conduct periodic cybersecurity risk assessments?

4. Do you assess cybersecurity risks associated with suppliers and external service providers?

5. Is multifactor authentication enforced for critical systems and accounts?

6. Are user access rights reviewed regularly and removed promptly when no longer needed?

7. Are privileged or administrator accounts restricted and separately controlled?

8. Are devices and systems regularly updated with security patches?

9. Have you identified and classified your organisation’s sensitive information?

10. Is sensitive information protected by appropriate encryption and access controls?

11. Are backups performed regularly and protected against ransomware?

12. Have you successfully tested restoration of critical data and systems?

13. Are security events and suspicious activities monitored?

14. Are endpoint protection measures deployed and maintained?

15. Do you have a documented cybersecurity incident response plan?

16. Have you tested your incident response and business continuity procedures?

17. Do employees receive regular cybersecurity and phishing awareness training?

18. Does your organisation maintain rules governing employee use of AI tools?

19. Are sensitive data and confidential documents protected from unauthorised disclosure to AI services?

20. Are AI applications, integrations and third-party AI services assessed for security risks?