Scribd
Upload
8 views11 pages

Cybersecurity Checklist

The document is a cybersecurity checklist for businesses, outlining essential security policies and practices to implement across various areas. It covers topics such as regular policy updates, staff training, hardware and data security, third-party risks, remote access, and user account management. The checklist aims to help organizations ensure comprehensive cybersecurity measures are in place to protect against threats.

Uploaded by

rajivharish6
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
8 views11 pages

Cybersecurity Checklist

The document is a cybersecurity checklist for businesses, outlining essential security policies and practices to implement across various areas. It covers topics such as regular policy updates, staff training, hardware and data security, third-party risks, remote access, and user account management. The checklist aims to help organizations ensure comprehensive cybersecurity measures are in place to protect against threats.

Uploaded by

rajivharish6
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 11

ers ec u r ity

Cy st
Ch ec kli

m b a t . c o m
Hackerco

Hacker Combat LLC


HACKER COMBAT LLC

This checklist sets out the key issues that a

business should deal with, and which should

be implemented where appropriate across

the entire suite of internal policies.


Types Of Security Policies

Information security policy

Privacy policy

BYOD policy

Remote access policy

Network security policy

Acceptable use/internet access policy

Email and communication policy

Depending on how your policies are structured,

the issues below may appear in one or more of

these policies.

Are your policies checked, updated on a

regular basis, and enforced?

Is there a board member with responsibility

for cyber security?

Does the CISO / Head of Information

Security meet regularly with the board

member responsible for cyber security?


Do you have clear responsibility for

cybersecurity, with clear reporting lines

and decision-making authority?

Do you ensure physical security of

premises?

Do you allocate sufficient budget to

cybersecurity?

Do you subscribe to cybersecurity

updates so that you are aware of

threats?

Do you have an effective breach

response plan, and do you test and

update it regularly?

Do you have appropriate cyberliability

insurance in place?
People
Do you have appropriate mechanisms for

staff to be able to report suspicious emails

quickly and effectively?

Do you train staff on cybersecurity

regularly?

Do you test staff, for example by sending

spoof phishing emails?

Do staff undertake reviews to ensure that

they understand cybersecurity risks, and are

results checked to ensure improvement?

Do you have proper onboarding / off

boarding processes, and are they applied in

practice?

Do your employees understand the risks of

using public WiFi?

Do you conduct appropriate checks on new

employees to understand if they are a

potential security risk?


Hardware, data, encryption
and technology
Is backup data encrypted?

Do you have appropriate mechanisms for securely

sending files?

Do you have a list of servers, and individuals who

are responsible for ensuring that they are up to

date?

Do you have appropriate firewalls and intrusion

detection software?

Do you ensure that test servers are appropriately

configured, and only contain dummy data?

Are your wireless networks appropriately

secured?

Do you have email and internet traffic filtering

software?

Do you regularly check the operating systems,

data and software against a 'good known state'

baseline?

Do you review unsuccessful attacks and probes /

scans?
Do you have a security roadmap, and do you

review it against your overall IT roadmap

regularly?

Do you have hardware and software asset

inventory lists?

Do you have an asset management policy?

Have you classified data by sensitivity and risk?

Do you appropriately limit access to data?

Do you have effective encryption of data at rest,

and is encryption in transit appropriate?

Do you back up data on a regular basis?

Do you have an appropriate patching policy and is

it applied consistently?

If you use automated patching software, do you

conduct periodic checks that it is operating

properly?

Do you have appropriate configuration

management systems in place?

Do you maintain log files for at least a year?

Do you use automated analytics on log files?

Do you have appropriate policies regarding use of

external hard drives or USB drives?


Third Parties

Do you properly understand risks arising

from third party service providers?

Do you undertake appropriate due diligence

before engaging third party service

providers?

Do you assess third parties for cybersecurity

risk?

Do you build appropriate contractual

obligations on third parties to take steps to

keep data secure?

If you use SaaS or cloud storage, do you

have appropriate contractual mechanisms

to be notified quickly of potential security

issues?
Remote Access/BYOD

Do you require multifactor authentication


where appropriate?
Do you allow remote access?

> If so, do you have appropriate software

and controls in place to ensure it is secure?

Do you have appropriate policies to


secure mobile devices?
> Is data encrypted on mobile devices?

> Can mobile devices be remotely wiped?

> If you use BYOD, do you apply appropriate

restrictions to personal use to maintain

security?

> Have you considered the use of secure

areas on BYOD devices?


User Accounts/Passwords

Do you require unique accounts?

Do you require multifactor

authentication where

appropriate?

Do you restrict administrator

accounts to the minimum

necessary?

Do you require strong, hard to

guess passwords?

Do you automatically prevent use

of common passwords?
Source: Globaldatahub
https://globaldatahub.taylorwessing.com/article/cybersecurity-checklist

Hacker Combat LLC

You might also like