A strong cyber security posture begins with thorough analysis of the basics: policies, procedures and standards.

Has your organization defined and implemented a cyber security policy with supporting procedures and standards?

Cyber Security Posture

Many breaches occur when data reaches unintended destinations. For example, corporate data landing on an employee's personal cloud storage, a misplaced USB thumb drive or even a "confidential" email being forwarded outside of the organization.

Have you identified the information in your organization that would be considered sensitive and made sure it is secured properly?

Identify Sensitive Information

Knowledge is power. Security knowledge is your advantage over the attackers. 
You must provide your employees with proper security awareness training.  
Have all of your employees recently received basic security awareness training about phishing and other cyber threats?

Security Awareness

Statistics don't lie: at some point, you will have a security breach.  What sets you apart from the rest of the breach victims is how quickly you can identify and react to the threat.

If your organization were to suffer a data breach, do you have controls in place to help you identify the breach?

Incident Detection and Response

A bug in an application can turn into a vulnerability.  A vulnerability assessment is designed to identify bugs and misconfigurations located in applications, systems and network devices in your corporate environment. 

Have you ever had a vulnerability assessment performed on your corporate environment?  

Vulnerability Management

A Penetration Test (PenTest) is designed to leverage the findings of a vulnerability assessment to see if an attacker could compromise your network and/or system.  It is the closest thing to what an attacker would attempt to get into your environment(s).
 
Have you conducted a PenTest within the last 12 months on your corporate environment? 

Penetration Testing

Do you regularly update servers, workstations and network devices to protect against the latest threats?

Regular Updates

Most successful cyberattacks begin with a compromised user account, especially one with privileged access. Once the attacker has a valid account, they can use it to login or to compromise yet another account.
 
Which aspects of access control do you currently have in place? (check all that apply)

Access Controls

We have become so intertwined with our mobile devices today. Much of our corporate data mingles with our personal data and the line in the sand has become very faint.  Because of this merging of data, you should have a Mobile Device Management Plan in place, which consists of technical controls as well as procedural controls.  
 
Is this something you have in place today?

Mobile Device Management

In the unfortunate event that you have a data breach, do you have the appropriate insurance coverage to address your cyber security requirements?

Cyber Insurance

Do you have a formalized incident response plan?

Response Plan

Has your plan been tested in the last 12 months?

Response Plan Testing

Does your organization maintain an accurate inventory of all assets including systems, software, data and user accounts?

Inventory

Do you have a formalized risk management plan that regularly identifies, assesses, and mitigates business and technical risk?

Risk Management Plan

Do you include supply chain and/or vendors risk in your risk management policies and procedures?

Supply Chain Risk

Do you have a formalized business continuity and disaster recovery plan?

What Is Your Cyber Security Score?