Please Complete our CAMS Lite Questionnaire

Gain Insight into whether your company has adequate controls, is prepared for consequences, and can recover from threats.

Start Questionnaire

Govern

1.

Has a senior executive been appointed who is accountable for the oversight and delivery of cyber security within the organisation?

A senior executive (e.g., COO, CIO) has been appointed who is accountable for the oversight and delivery of cyber security and the assignment of associated roles and responsibilities. This is either their dedicated role or a significant proportion of their role.

A senior executive has been appointed who is accountable for the oversight and delivery of cyber security and the assignment of associated roles and responsibilities. However, this is not their dedicated role or a significant proportion of their role.

Someone (not a senior executive) within the organisation has been appointed and is accountable for the oversight and delivery of cyber security and the assignment of associated roles and responsibilities. There are plans to appoint a senior executive in the future.

No-one has been appointed to be accountable for the oversight and delivery of cyber security.

Govern

2.

To what extent is management information (MI), including Key Risk Indicators (KRIs), used to inform decision makers on the residual risk levels against risk appetite for cyber defined risks?

Senior executives review cyber MI at least quarterly on a range of cyber security measures, including the performance of the security function as a whole. This MI is used to support the discussion of cyber and relevant decision-making.

At least one senior executive reviews MI at least quarterly on cyber security measures, including the performance of the security function as a whole. This MI is used to support the discussion of cyber and relevant decision-making.

Non-executives, such as technology or operational leads, review MI on cyber security measures. This MI is used to support relevant decision-making.

MI on cyber security measures are not regularly reviewed.

Govern

3.

Do you have sufficient control and oversight of your supply chain?

All outsourcing and third party providers are risk assessed, and minimum requirements for security are set. There are a combination of measures (e.g., contractual, monitoring, ongoing engagement, data protection, auditing etc.) in place to validate adherence to security requirements.

For all critical outsourcing and third party arrangements, clear risk assessments and minimum security requirements are set. There are a combination of measures in place to validate adherence to security requirements; the organisation does not solely rely on contractual provisions with the third party.

All outsourcing and third party providers are subject to a standardised procurement process with minimal or no security considerations. Monitoring, where it occurs, does not consider usually security.

There is no control and/or oversight of the supply chain.

Identify

4.

Do you proactively inventory all information assets (operating systems, applications, servers, network devices), identify relevant security vulnerabilities, and patch them using a risk prioritised methodology?

Information assets (hardware, devices, data, personnel, and software) are identified, prioritised, and documented in an inventory on an ongoing basis. Assets are scanned for vulnerabilities on an on-going basis and patches are applied in a defined timeframe.

Information assets and systems are identified, prioritised, and documented in single/multiple inventories which are reviewed at set intervals. Vulnerability scanning takes place on at least a monthly basis, and patches applied or the risk formally accepted.

Information assets and systems are identified, prioritised, and documented, and these are reviewed on an ad-hoc/infrequent basis. There are inconsistent vulnerability scanning and patching processes.

Information assets and systems have not been formally identified, prioritised and documented. There is no consistent vulnerability identification or patching process in place.

Protect

5.

Does all remote access to the corporate network and business applications require strong authentication?

All remote access to the corporate network, business applications and data (including 3rd party online services) requires at least two-factor authentication for non-privileged and privileged users.

Remote access to the majority of corporate network, business applications and data requires at least two-factor authentication.

Remote access for a limited / selected number of corporate network, business applications and data requires at least two-factor authentication.

Remote access to the majority of corporate network, business applications and data does not require multi-factor authentication.

Protect

6.

Are privileged rights understood, documented and reviewed in terms of assignment to system and user accounts?

Dedicated privileged accounts exist, and are used to separate and segregate 'normal' user accounts activity where individuals' (including third parties) privileged and/or high-risk credentials are centrally managed, monitored, and have additional security measures. The individuals, their documented rights, their duties, and their logged activities are independently monitored and reviewed on an ongoing basis to ensure they are appropriate and still required.

Dedicated privileged accounts exist, and are used to separate and segregate 'normal' user accounts activity where individuals' (including third parties) privileged and/or high-risk account credentials are centrally documented. Access privileges and permissions are independently monitored and reviewed at regular time intervals to ensure they are appropriate and still required.

Individuals' privileged and/or high-risk rights are centrally understood and enforced as part of a joiners-movers-leavers process. Reviews of the on-going requirement for the privileges are conducted on an ad-hoc/infrequent basis.

There is no centralised view of individuals' privileged or high/risk credentials or their assignment.

Protect

7.

Are applications in use by the company restricted to those that been approved by management, and are configured to enforce security?

Only applications that have been approved by management are used by staff and are configured to prevent the use of unapproved / malicious programs. Microsoft Office Macros that originate from the internet are blocked and unneeded features disabled, and web browsers are configured to block unwanted / insecure activity.

Only applications that have been approved by management are used by staff and are configured to prevent the use of unapproved / malicious programs. You uninstall and remove end of life, end of support software and services but not necessarily unauthorised and unnecessary software, services, and/or software components.

There is an ad hoc / inconsistent control of applications and software.

There is no direct management control of the use of applications and software.

Protect

8.

Do you monitor and adjust the security configuration of your email system to prevent and detect malicious activity?

The security of the use of email has been enhanced by only allowing approved attachment types, the analysis / sanitisation of hyperlinks, the central configuration of SPF, DMARC and DKIM, the enforcement of TLS encryption v1.3, enablement of Microsoft 365 message encryption (or similar), enablement of a Data Loss Prevention (DLP) capability, the blocking of auto forwarding to external domains, implementation of warning tags for external email and enabling (where applicable) pre-set security policies in Microsoft 365 Defender.

You have not taken steps to enhance the configuration of your email security.

Recover

9.

To what extent have you identified and assessed the cyber risk within your important business services?

All important business services and their underlying people, processes, and technology are dynamically assessed to identify areas or sources of cyber risk. These risks are monitored, assessed, and prioritised to reflect the current threat landscape, relevant changes (e.g., M&A activity, major out- or in-sourcing, business delivery model etc.) to the service(s), and the effectiveness of current internal controls. Cyber risks are integrated into the enterprise risk management framework.

All important business services and their underlying people, processes, and technology are regularly assessed to identify areas or sources of cyber risk against the current threat landscape and internal controls reviewed and updated at set intervals.

Reviews of important business services are underway to identify areas or sources of cyber risk, or such reviews have occurred but are not systematically run.

There is no identification of cyber risks within important business services.

Recover

10.

Do you have secure backups of data and information that would be needed to recover the operations of your business services and could be accessed during an incident?

All data are synchronistically backed up, to ensure a common restoration point, and encrypted in line with business requirements, (including by at least one format that does not require continuous access to the network) and are retained in a secure and resilient manner. Only privileged accounts can access backups, and integrity checks validate the readiness of all critical business service backups for use.

All data are synchronistically backed up, to ensure a common restoration point, in line with business requirements. Backups are retained in a secure and resilient manner, and integrity checks validate the readiness of most or all important business service backups for use.

Critical data are backed up, and backups are hardened against damage or deletion.

Data are not or are inconsistently backed up.

Your Details

11.

Please provide your contact details so that we can follow-up and share your CAMS Lite Questionnaire results with you.

Name*

Email*

Company Name

Phone

Submit Your Answers

We'll assess your responses and be in touch soon with a full report on your preparedness for cyber threats and how to respond to them.

Thank You for Completing the CAMS Lite Questionnaire!

We will be in touch soon with your results.

Learn More About Us

Oops! Something went wrong while submitting the form.

Get In Touch

Get in touch using the contact form or directly using our contact details below.

Call us today

+44 (0) 20 7460 0426

Send us an email

info@digitaloversight.ai

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.