- Does your organization have an information security policy and procedural plan (including protective control of data, secure ICT access and documented procedures)?
- Does your organization have procedures for information security incident management that include detection, resolution and recovery?
- Does your organization have an information security implementation strategy as per the risk analysis results that its implementation is undertaken as part of your organizations work plan?
- Does your organization have formal contractual arrangements with all contractors and support organizations that include the responsibilities in respect of information security and confidentiality?
- Does your organization have a policy that details specific employee and contractor responsibilities for information security before granting access to sensitive assets?
- Does your organization have an individual who is accountable for information security and who defines security processes, risk management processes and enforcement vehicles for your organization?
- What certification requirements does the audit organization provide to ensure that the enterprise complies with the ISO/IEC 27001 Information Security Management Framework?
- Does your organization have a strategy for the use of information security technologies that are implemented and updated according to the needs and changes in the risk profile?
- Do you have the right policies and procedures to ensure your data use and information security practices are up to date and allow you to take appropriate enforcement actions when you need to?
- Does your organization have a policy for all employees and contractors to report violations of information security policies and procedures without fear of recrimination?
- Does your organization have an ongoing information security risk assessment program that considers new and evolving threats to online accounts?
- Does your organization have a documented and provable internal information security policy in place that details your information protection program for both logical and physical security?
- Does your organization have adequate governance committees and structures in place to ensure appropriate oversight and monitoring of key information security risks?
- What governance arrangements does your organization have in place to implement and maintain its information security plans and measures?
- Do you have an engaging and effective information security awareness program in place across your organization designed to influence and drive new cyber resilient behaviours?
- How does your organizations information security risk management (ISRM) mediate the relation between IT capabilities and organization performance?
- What action has your organization taken to ensure that testing and evaluating controls becomes an ongoing element of each departments overall information security management program?
- Do you outsource your information security management to a qualified organization specializing in security or have staff responsible for and trained in information security?
- Does your organization have a named Chief Information Security Officer (CISO), or alternatively a single individual who has the authority to approve cybersecurity related decisions?
- How does your organization ensure that the output of IT Resources and IT processes match the information security criteria established for meeting key business objectives?
- Does your organization have a function or section that has the duty and responsibility explicitly to manage information security and maintain its compliance?
- If your organization outsources system management, does it confirm mechanisms for information security management at the outsourcing firm, and has it monitored other conditions?
- Does your organization have a documented and approved information security plan, that includes a dedicated data protection security team?
- Does your organization has an access control policy that is established, documented and reviewed based on business and information security requirements?
- Based on your information security risk management strategy, do you have official written information security policies or procedures that address each areas?
- What is the role of the top management in implementing an information security policy in organization according to the literature and what is your organizations view of the role?
- What types of human and technology resources are needed to support the information security and risk management your organization expects?
- What procedures, methodology, and timetables does your organization have in place to detect information security breaches and notify your organization and its customers?
- What process information security safeguards does your organization not have in place, and is a priority over the next 12 months?
- What process information security safeguards does your organization currently have in place?
- Do your vendors have designated cybersecurity personnel, as a Chief Information Security Officer, and do the vendors require its staff to undergo cybersecurity and data privacy training?
- How often does your organization conduct security tests and what factors should go into determining the frequency of tests?
- Does your organization have a Chief Information Security Officer, chief security officer, or similar executive level cybersecurity position in place today?
- Does your organization have language in supplier agreements which govern the transfer, use and storage of customer information and protect against fraud and other information security breaches?
- What consequences could your organization face if it does not have specific information security guidelines and policies?
- Has your organization implemented a risk assessment program to proactively identify information security and business continuity risks?
- Are there processes and procedures established for information security requirements for each type of vendor and type of access based on your organizations business needs and the risk profile?
- How does your organization ensure that your organizations information security plan is practiced throughout the life cycle of each business system?
- Do your service providers have a copy of your information security policy and are they willing to comply with the policy as well as the data protection standards within?
- Do you have a written information security strategy that seeks to cost effectively measure risk and specify actions to manage risk at an acceptable level, with minimal business disruptions?
- In setting limitations to systems access, have you considered the risks to information security arising from cleaning staff and waste disposal methods?
- Do you have agreement with the suppliers about information security requirement for mitigating the risk associated with suppliers access to your organizations assets?
- Does your organization have defined policies and measures to combat information security incidents that involve legal (criminal and civil) violations?
- Are information security risks analyzed to assess the realistic likelihood and potential consequences that would result, if they were to occur, and have the levels of risk been determined?
- Does your organization have information security specialists conduct regular vulnerability testing against applications as they are deployed?
- Does your organization have information security policies and procedures including, and not limited to physical security and environmental controls?
- Based on your information security risk management strategy, do you have official written information security and privacy policies, standards, or procedures?
- Does your organization have established processes for escalating and responding to information security incidents within all organizational departments and functions?
- Have you developed a continuous monitoring strategy for the information systems (including monitoring of security control effectiveness for system-specific, hybrid, and common controls) that reflects the organizational Risk Management strategy and organizational commitment to protecting critical missions and business functions?
- Does management communicate to your organization on the importance of meeting the information security objectives, conforming to the information security policy and the need for continual improvement?
- What steps does your organization take to ensure that contractors and third parties that handle personal information on its behalf do not breach information security requirements?
- Does your organization implement an appropriate level of information security training and/or awareness campaigns for employees prior to granting them access to information systems and facilities?
- What management system have you established to assure effective assignment of accountability for the security of your information and supporting technology resources?
- Is information security risk assessment a regular agenda item at it and business management meetings and does management follow through and support improvement initiatives?
- Do you have an official information security architecture, based on your Risk Management analysis and information security strategy?
- Has your organization conducted a risk assessment within the last two years to identify the key objectives that need to be supported by your information security and privacy program?
- Does your organization establish, document, implement and maintain processes, procedures and controls to ensure the required level of continuity for information security during an adverse situation?
- Does the board/executive management team have a comprehensive understanding of information security to fully evaluate cyber risks and preventive measures?
- Do you have a current Risk Assessment which includes information security risks and includes risks to data subjects for the information you hold?
- What risk does your organization become exposed to with a poor information security strategy and what do you done to mitigate this risk?
- Which information security standards have your SaaS vendors benchmarked their organization against?
- How compliant with information security standards, government regulations and internal policies are the third parties your organization does business with?
- Do you have an integrated approach to information security across your organization that reflects the challenges of the current security environment?
- Does your organization periodically test and evaluate or audit your information security program, practices, controls, and techniques to ensure they are effectively implemented?
- What kind of information security threats does your organization or line of business encounter regarding social media?
- Have there been any breaches of security involving equipment or at your facilities where organization information is stored?
- How does your organization ensure an adequate and appropriate level of information security over third parties?
- Do you have a procedure to perform an identification, analysis and evaluation of the information security risks possibly affecting personal data and the IT systems supporting the processing?
- Have you documented and established procedures and controls to ensure continuity for information security during a disaster or crisis?
- Does your organizations information security function have documented, implemented and maintained processes to maintain continuity of service in an adverse situation?
- Does the board get direct feedback from the Chief Information Security Officer or some equivalent officer who can account for in business and strategic terms the cyber risk and controls approach?
- Do all implementers of information security in your organization have adequate competence and expertise by applicable requirements/standards?
- How do you verify the information security continuity controls at regular intervals in order to ensure that they are effective?
- Do executive and line management take formal action to support information security through clearly documented direction and commitment, and ensure the action has been assigned?
- How have you determined your requirements for information security and the continuity of information management in the event of disaster or crisis?
- Does your organization replace factory default settings to ensure that your information security systems are configured in a secure manner?
- Does your information security function have the authority it needs to manage and ensure compliance with the information security program?
- Does the system development life cycle process used in the management of information technology include information security considerations?
- Before they are granted access to IT facilities, are users trained in information security policies and procedures, security requirements, business controls and correct use of IT facilities?
- Has an information security risk treatment plan been formulated and approved by risk owners, and have residual information security risks been authorised by risk owners?
- Do you have a process in place to monitor and adjust, as appropriate, the information security program?
- What options do the chief information officer (CIO) or Chief Information Security Officer (CISO) have when trying to communicate security risk to the board?
- Do your service providers have a formal change control process for IT changes and are information security implications a formalized part of change control and review?
- Are information security and privacy issues considered in all the important business decisions within your organization (project development, vendor selection, purchasing, etc.)?
- Is an information security governance program required to ensure that security is integrated with your organizations business processes?
- Does management actively support security within your organization through clear direction, demonstrated commitment, explicit assignment, and acknowledgment of information security responsibilities?
- Do information security officers have the appropriate authority to implement and ensure compliance with information security programs?
- Which strategies ensure that employees can identify a threat to information security assets, and how is it ensured that employees will react to such situations?
- Does your organizations audit trail program have daily or automated log reviews that are capable of quickly detecting if an information security incident has occurred?
- Do you have written contracts in place to enforce your information security policy and procedures with third party service providers?
- Does your organization periodically test and evaluate the level/compliance status of existing information security programs to ensure that all initiatives are implemented efficiently?
- Does your organization account for policies regarding the use of peer to peer file sharing in information security awareness training, ethics training, or any other organization wide training?
- Does your organization have an established governance structure for combined business and IT decision making, including information security and privacy?
- Is the information security risk assessment a regular agenda item at IT management meetings, and does management follow through with improvement initiatives?
- Have you implemented an information security policy to manage the security of information related to your IoT technology throughout your organization?
- Does the information security function report regularly to the executive management on compliance and the effectiveness of the information security and privacy program and policies?
- Has your organization updated its information security awareness and training programs for employees to cover the possibility of cyber attacks involving extortion?
- Do your organizations information security professionals conduct vulnerability tests of the software it has developed, regardless of whether it was outsourced or produced in house?
- What information security risk processes are applied, including Threat/Risk Assessments, Privacy Impact Assessments, Security Management Plans and audits?
- Has your organization established a POA&M program that is consistent with FISMA requirements, and applicable NIST guidelines and tracks and monitors known information security weaknesses?
Bachelor of Commerce - BCom from Nizam College at Hyderabad Public School
2 年????
PT Bukit Asam Tbk - Member of MIND ID Holding Group
2 年Helpful insights