CYBERSECURITY SELF-ASSESSMENT How safe/secure is your organization? Is your organization sufficiently protected against cyber-attacks? What are the most important cyber risks of your organization? And will your organization be able to adequately respond in case of a cyber incident? It takes about 10 minutes on average to respond to the 25 questions of this self-assessment and to determine the cybersecurity maturity level of your organization. The result will immediately be sent to you by e-mail. Take the test Disclaimer The assessment data will of course be treated confidentially. If you wish, we can have a discussion on the results of the assessment afterwards. If you explicitly agree, these data will also be used anonymously for our cybersecurity survey, which will allow you to compare your organization with similar organizations. In this case, you will receive the report within a couple of months by e-mail. If you have any questions on this cybersecurity assessment, feel free to contact us via ras@bdo.be. Please consult our BDO privacy policy. 10% 10% Hi there stranger! My name is Nick. What's your name?Nick 20% 20% Nice to meet you, ! Before we can start with the assessment, I need to know a bit more about your organization.Nick What is the name of your organization? * What is your role within the organization? * How many employees work at your organization? * 1 to 49 50 to 199 200 to 499 500 to 1999 2000 to 4999 5000 or more Which category best defines your organisation’s primary industry? * Construction Education and training Electricity, gas, water and waste services Financial and insurance services Health care and social assistance Information media and telecommunications Manufacturing Professional, scientific and technical services Public, non-profit Rental, hiring and real estate services Retail Transport, postal and warehousing Other 40% 40% Thank you, ! I got all the basic info I need, let's start with the assessment.Nick Do you have a user administration process for new employees and leaving employees? * No Yes, but not documented A formally documented process Are user privileges reviewed? * No Reviews are performed on an ad-hoc basis Only administrator accounts are reviewed All user privileges are monitored on a periodic basis Are complex passwords enforced within the organization? * No Less than 8 characters and no other requirements 8 characters or more, special characters, upper- and lower case, number and required change on a periodic basis Multi-factor authentication Do employees, individuals or third parties have remote access to your network? * No Continuously without monitoring or tools Remote access tools to access the corporate network from outside Facilitated via VPN Do you perform security awareness training? * No Only for new employees For all employees on a periodic basis Mandatory for all employees and management, periodically, with assessment of understanding Are laptops of employees encrypted? * Unencrypted File encryption Hard Drive encryption Full encryption and no data stored locally Are backups stored remotely, and if so are they properly protected? * Not stored remotely Yes, but physically unsecured Yes, but unencrypted Yes, encrypted Are patches installed on a timely basis? * Not monitored Patches are installed on an ad-hoc basis A formal patch management process is in place and covers servers, clients and security devices Do you have a wireless Corporate network? * Published SSID with weak password Published SSID with complex password Hidden SSID, complex password (+ additional measures) Do you have a wireless Guest network? * Yes Yes, fully isolated with no access to internal network No No, guest connect to our corporate network Do you have security & privacy policies? * No On-the-shelf Approved by board, trained, signed by employees, enforced, … Do you have a security function within your organization? * No Security functions within the technical/IT team Dedicated security team Do you have an incident response and recovery plan? * No Our response team operates between business hours Our response team is 24/7 on stand-by with immediate response when required Do you have an anti-virus? * No Installed on employee computers Installed on all computers and servers Advanced End-Point Protection Do you protect your environment with a firewall? * No Residential grade firewall Each network entry/exit point has a commercial grade firewall that is vendor supported Each network entry/exit point has a commercial grade firewall that is vendor supported and configurations are reviewed on a periodic basis Do you perform internal vulnerability scans? * No Ad-hoc Internal vulnerability scans are running across all systems at least once a year Yearly penetration testing is performed 70% 70% Well done, ! I'm calculating your cybersecurity maturity score. I would like to finish the assessment with some general questions on cybersecurity.Nick Was your organization in the past year victim of a cyberattack? * Yes No I don’t know I’d rather not disclose this information What kind of attack was performed? Social Engineering (phishing, invoice fraud, CEO fraud, …) (Distributed) Denial of Service attack Exploitation of vulnerabilities Malware Ransomware Human error Data breach Brute force attack Physical security breach Theft of laptops or mobile devices Other What was the cost related to the cyber incident? (including spend on assistance from third party providers/services)? Do not know / would rather not say Less than €19,999 €20,000 to €99,999 €100,000 to €499,999 €500,000 to €999,999 €1 million to €5 million More than €5 million Compared to this time last year, are you more or less confident in your organisation's ability to respond to a cybersecurity incident and recover from any associated negative impacts? More confident Less confident No difference in confidence level Do not know / would rather not say Does your organisation have cyber insurance? No ‐ we were not aware of this type of insurance No ‐ we don’t feel we need it No ‐ we believe this risk is covered under other insurance policies we have No ‐ we self‐insure Not yet ‐ we are considering it Yes ‐ we have a standalone cyber policy Yes ‐ we have this covered as an extension to another insurance policy Yes ‐ but do not know how the policy was arranged Do not know / would rather not say Is there anything else you whish to share or ask me? 100% 100% You've reached the final step of the assessment. I will send you the results. What email address can I use?Nick Would you like to share your telephone number in case we would like to contact you about the assessment? Can we include the results of this assessment in our overall cybersecurity study? Your data will be treaded anonymously. Yes, I want to contribute to this study. Can we contact you to discuss the results of the self-assessment? Yes, you can contact me to discuss my results. Can I add you to the BDO Belgium mailing list, ? You're able to change this preference at any time. Yes, keep me informed about BDO events & services. I accept the BDO Privacy Statement. Dutch French English German
