Cybersecurity Review

Please score each item from 0 to 5. 0 means not done or don't know. 5 means your organization has a very mature, consistently followed process.

Company name

Your name

Email address

Anything you'd like me to know before I review this?

Govern

Do you have an identified owner for cybersecurity risk and decision-making?

Do you maintain and review core security policies and standards?

Do you perform periodic risk assessments and track remediation actions?

Do leadership and business owners review cybersecurity priorities, risks, or metrics on a regular cadence?

Do you maintain an inventory of hardware, software, SaaS apps, and key data stores?

Do you know which systems, vendors, and processes are most critical to the business?

Do you classify sensitive data such as PII, PHI, PCI, financial, or confidential company data?

Do you assess third-party or vendor cybersecurity risk before and during the relationship?

Is MFA enforced for email, VPN, admin accounts, and critical cloud apps?

Are user access rights granted by role and reviewed periodically?

Are systems patched, hardened, and protected with endpoint security?

Are backups protected, tested, and available for business-critical systems?

Are security logs collected for critical systems, cloud services, and admin activity?

Do you monitor for suspicious activity such as failed logins, malware, or unusual admin actions?

Do you perform vulnerability scanning or other routine security checks?

Are important alerts triaged by a person or provider within a defined timeframe?

Do you have an incident response plan with defined roles, contacts, and escalation paths?

Do you have procedures for containment, eradication, communication, and evidence preservation?

Do you test the incident response process through tabletop exercises or drills?

Do legal, HR, leadership, and IT know what to do during a security incident?

Do you have a recovery plan for restoring critical systems after a cyber event?

Are backups and recovery steps tested often enough to give you confidence they work?

Do you define recovery priorities, such as which systems must be restored first?

After incidents or tests, do you capture lessons learned and improve plans and controls?