Express Cyber Security Assessment

Does your organization have specific assigned roles responsible for overseeing the implementation of information security policies and procedures according to an established framework or governance strategy?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Have you conducted an inventory of all authorized and unauthorized devices and software using an automated discovery and inventory tool?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Do you regularly conduct vulnerability scans to detect assets that don’t conform to approved configurations management protocols or that are out of patch?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented

Have you performed an inventory of your information assets to discover what types of sensitive data you house (IP, PCI, PII, ePHI, etc)?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Are the results of these inventories provided to your organization’s risk management function to scope, assess, and mitigate the risk to the assets using a commonly accepted risk management framework?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Do you segment your network in such a way that sensitive or high-risk assets reside on network segments that are separate from general use assets?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented

Do you control access to sensitive assets on a “least-privilege” basis using a request and authorization process, followed by a separate enablement process?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Do you mandate Information Security training covering topics such as acceptable use of information systems, malware and ransomware threats, password protection, and safe web browsing and email practices on a recurring basis for all employees?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Do your change management policies and procedures ensure that all changes go through a test phase in a test environment and are vetted by stakeholders before entering production?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented

Has your organization formally adopted an incident response process that includes criteria for investigating possible incidents based on indicators detected through systems monitoring?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented
Do you require external partners who will access your information systems or will house or process your data to accept contract provisions governing: data destruction; incident notification; hiring practices for those who will have access?*
Fully Implemented Largely Implemented Partially Implemented Minimally Implemented Not Implemented

Secure Halo Express Assessment