Questions

• How well do you understand your organization’s cyber risks?

  Do you understand and periodically review the organization’s exposure to cyber compromise? Do you know how to address the risk of a cyber breach, and ensure that cyber resilience is built into the core operating processes?

• How well do you understand the consequences of a breach?

  Do you understand the consequences to the organization and clients in the event of a failure or disruption of operating systems or the compromise of intellectual property, commercially sensitive information, or data held in trust for employees and clients (such as personal, financial, and credit card details)? Can you predict how such a breach will be reflected in the organization’s reputation, and credibility?

• How well do you understand your IT systems and the data it holds?

  Do you understand the value of your data to those of malicious intent? Do you know where the data is, how it is protected, and who has access to it?

• How good is your cyber hygiene?

  Do you have regular patching of software and operating systems, password policies, multi-factor authentication (MFA), monitoring, email threat detection?

• How solid is your backup and recovery process?

  Do you have a backup strategy that is redundant and can recover your operations quickly after an attack? Do you review the response plans on a regular basis, so it is ready to be implemented immediately if an attempted attack is detected?

• Does your technology roadmap include a cybersecurity investment plan?

  Do you have a continuous investment plan that allows you to upgrade and refine your protective systems as a normal cost of business?

• Is your organization culturally committed to cyber security?

  How strong are your security controls, including access and usage monitoring? Does security play a part in your overall management processes? Do you have a culture that consists of an informed and committed staff with regular training and testing?