Cybersecurity Risk Review

1. Backups of data are created, protected, maintained, and tested

Knowing where your backups are located and who is responsible for restoring them are the first steps to recovery

Yes No I Don't Know

2. Multi-factor authentication is enforced for all accounts

Multi-factor authentication means having more than one way to prove your identity besides a password. This can be SMS, email, or an authenticator app. Having at least one authentication factor that cannot be shared helps prevent phishing attacks.

Yes No I Don't Know

3. Installation and execution of unauthorized software is prevented

Authorized software is software that has been acquired from a trustworthy source, evaluated by your IT department, and is included in regular maintenance schedules. Unauthorized software is any software that does not meet these criteria.

Yes No I Don't Know

4. Our IT department automatically receives a notification if a critical service goes down

Having your IT department immediately receive incident notifications allows them to act before your employees or clients experience disruption.

Yes No I Don't Know

5. Employees are required to complete regular cybersecurity awareness training, and non-compliance is actively monitored and addressed

Regular cybersecurity awareness training is provided to employees in order to stay up-to-date with evolving threats. Risky behaviour is identified and corrected.

Yes No I Don't Know

6. We have a centralized asset inventory system of all managed hardware

A comprehensive list of your organization's assets informs what you need to protect.

Yes No I Don't Know

7. We have prioritized which critical services to restore in order of business importance

Prior to a major outage, leadership and IT should have a clear and shared understanding of priorities established.

Yes No I Don't Know

8. We have established breach notification procedures

Documentation should include details of which specific team members need to contact external parties, and what information should be conveyed.

Yes No I Don't Know

9. We have a documented inventory of applicable legal, regulatory, and contractual cybersecurity requirements

Without having these documented and shared with IT, it cannot be known that your organization is in compliance.

Yes No I Don't Know

10. Overall, I am confident that our organization would be resilient when faced with a cyberattack or disaster

Yes No

Fill in your name and email and click submit to get in touch and see how EMKAL can help you improve.

5-Minute Cybersecurity Risk Review