Self-assessment

Passwords

Do you have rules in place for your passwords?

No rules, passwords have no creation or reuse criteria. ( optional )

There are some rules around password creation but no history or reuse checks. ( optional )

There are common requirements for all passwords and they should be changed regularly. ( optional )

There are strong requirements for all users and most systems and these are only changed if there is an indication of a violation. ( optional )

Two-factor authentication is in place for all critical systems. ( optional )

System maintenance

Do you update your systems and applications?

No, we do not make any updates as long as the systems continue to work. ( optional )

Manual updates are done when needed or for the most critical systems. ( optional )

There is a standard procedure for scheduling updates. ( optional )

All systems are quickly updated to their latest versions. ( optional )

All updates are done continuously and systematically, and are tested before implementation. ( optional )

Antivirus and anti-malware management

Do you have antivirus or anti-malware software installed?

No, none. ( optional )

On some major systems but not everywhere. ( optional )

On all systems but they are not necessarily updated. ( optional )

On all systems and updated a few times a week. ( optional )

On all systems and updated daily. Suspicious activity is also reported. ( optional )

Network security

Are you protecting your network?

Not actively: the network is not segmented and connected to the internet without updates and strong passwords. ( optional )

In a limited way: the public and internal networks are separated and protected by a firewall. ( optional )

Basic protection: a number of segmentations exist according to functions and needs and everything is documented. ( optional )

The security of the network is measured and monitored; anomalies can be detected. ( optional )

The network is compartmentalized into strictly separated areas; anomalies are quickly detected and resolved. ( optional )

Backup procedure

Do you have a backup procedure?

No, neither systematic nor documented. ( optional )

Backups are limited and manual, and restoration is not tested. Sometimes the backups are done locally by the employees themselves, on USB sticks or external hard drives. ( optional )

Backups are tested and available for all major systems, and file restores are tested regularly. ( optional )

Backups are encrypted, available to all systems in the organization and tested immediately with performance metrics to improve. ( optional )

All data is backed up completely with fast recovery time and without data loss. ( optional )

Administration rights

How do you protect your administrator accounts?

Without an overview of our administrators' accounts; we do not specifically protect them. ( optional )

We manage administrator access only on certain services. ( optional )

All administrator access is distributed in separate accounts and is managed centrally. ( optional )

All administrator accounts are strictly monitored with automatic notifications in case of anomalies. ( optional )

Administrator accounts are disabled or modified if there are changes and anomalies. ( optional )

Physical security

Do you have measures in place to physically protect access to your premises and infrastructure?

We have nothing in place. ( optional )

We only protect critical systems (e.g. server room). ( optional )

All our infrastructure is protected, including fire and flood protection. ( optional )

We centrally control access (e.g. badges) and segment access according to confidentiality levels. ( optional )

Access control is centralized, regularly reviewed and follows the life cycle of employees (entry/change of position/exit). ( optional )

Incident Preparedness

Do you have an incident management plan?

No, we haven't looked at that yet. ( optional )

We have a plan but the responsibilities are not clear and our suppliers have not been identified. ( optional )

Our plan is validated internally and actively communicated to all parties involved, ensuring good coordination between the players. ( optional )

We have a plan and we have already tested it. ( optional )

We regularly test and improve our plan, including the communication and coordination parts. ( optional )

NIS2, Are you in scope?

Are your accounts well protected?

Cyber Fundamentals SMALL

Register your organisation