Company Information:
Please provide the company name and primary contact information.
Does your company have a dedicated security team or security officer?
Security Policies and Procedures:
Do you have written security policies and procedures? If yes, how often are they reviewed and updated?
Are your employees required to undergo security awareness training? If yes, how often?
Are your security policies and procedures aligned with any recognized cybersecurity frameworks (e.g., ISO 27001, NIST)?
Access Controls:
Describe how access to systems and data is managed within your company.
Are strong password policies enforced in your company?
How is access to systems and data removed when an employee leaves the company or changes roles?
Data Security:
How is sensitive data protected during transmission and at rest?
Please describe your data encryption practices.
Do you conduct regular vulnerability scans and/or penetration tests?
Incident Response:
Do you have an incident response plan in place?
Have you experienced any security incidents in the past two years? If so, how were they managed and what steps were taken to prevent recurrence?
Third-Party Management:
Does your company use subcontractors or outsourced services? If so, how do you manage their access to data and systems?
Have you conducted a risk assessment of your own third-party vendors?
Business Continuity and Disaster Recovery:
Do you have a business continuity plan and disaster recovery plan in place?
How often do you test your disaster recovery plan?
Compliance:
Is your company subject to any cybersecurity regulations? If so, please describe how compliance is ensured.
Has your company undergone any third-party security audits? If yes, can you share the results?
Risk Management:
Does your company have a formal risk management process in place?
How often do you evaluate and update your risk assessments?
Data Protection and Privacy:
Do you have a designated Data Protection Officer (DPO) or a similar role in your organization?
Please explain your process for managing and securing customer data.
Do you have a process in place for handling data breaches involving personal data?
How do you ensure the privacy of the data you handle?
Physical Security:
How do you ensure the physical security of your premises and data centers?
Are there security measures in place to prevent unauthorized physical access to your systems?
Secure Development:
If you develop software, please describe your secure development practices.
Do you use Static and Dynamic Analysis Tools to detect vulnerabilities in your software?
Is your code reviewed for security vulnerabilities?
Network Security:
How is your network secured against external and internal threats?
What types of security technologies (firewalls, IDS/IPS, etc.) do you use to protect your network?
Are all network devices updated and patched regularly?
Monitoring and Auditing:
Do you continuously monitor your systems and networks for suspicious activity?
Are logs maintained for all system, network, and user activities?
How long are logs retained and how are they protected?
Cybersecurity Insurance:
Does your organization have cybersecurity insurance coverage?
Can you provide details about the terms and coverage of your cybersecurity insurance policy?
Please provide any additional comments or information that may assist in our assessment of your cybersecurity posture. Thank you for your cooperation.