Are you aware of all the systems, websites, and domain names you use?

Do you have established procedures and policy documents for risk management?

Have you identified and taken additional measures to safeguard your company’s ‘crown jewels’ (systems and data), both internally and externally?

Are advanced access controls, like Multi-Factor Authentication (MFA) and Single Sign-On (SSO), implemented for email, core applications such as databases and other critical applications?

Are all employees regularly trained in cyber security, including spam and phishing recognition?

Is data protection aligned with an established risk policy to ensure confidentiality, integrity and availability?

Are there clear roles and responsibilities defined for protecting information?

Is there a designated individual responsible for timely updates, with established SLAs?

To what extent have technical solutions been implemented to protect and defend systems and assets?

Is your network equipped to promptly detect and respond to malicious activities?

How are security alerts from different systems handled?

In case of a cybersecurity incident outside regular office hours, do you have confidence that it will be handled appropriately?

Do you have a clear understanding of past incidents and the actions taken to prevent their recurrence?

Do the individuals responsible for evaluating security alerts have the necessary knowledge and experience to do so effectively?

How confident are you that your business would recover quickly in the event of an incident right now?