Choose the answer that most closely aligns with your security practices today. Your results will be collected in aggregate and anonymously.
1. How would you describe your current security prowess?
- I have a desire to understand it but don’t have the know-how.
- I've started digging into security and now need investments in time, talent, and treasure.
- I have a plan and a roadmap for every situation.
- I have good experience in security to share with others so we can fight this together.
2. How much are risk assessments part of your ongoing practice?
- I do not currently perform risk posture assessments.
- I assess and discover vulnerabilities, but don’t remediate beyond what our budget allows for.
- I do risk assessments for the company and follow up with a remediation plan and a timeline.
- Our company's risks are continually assessed, remediated, and tested as part of our standard procedures.
3. What is your current approach to security?
- I recommend solutions when there is an incident or I discover an issue.
- Made sure every department has met our minimum requirements for security in today’s threat landscape.
- We have solid security offerings with advanced features for greater protection.
- We have end-to-end strategic platform to deliver a comprehensive security.
4. What drives your company to advance your security offering?
- Requests and expectations around what we’re delivering.
- Company's willingness to spend money on advanced security.
- Company's desire to put more focus on security protections.
- Part of our strategic plan to be more security-focused.
5. What are your company's expectations of your responsibilities for security?
- They believe I own security and responsible if something happens.
- We have discussions about the ownership of security risks.
- There is mutual agreement on ownership of risk.
- We have developed a joint security risk management strategy with clear communication and boundaries.
6. What is your incident response plan made up of?
- Backups and cybersecurity insurance only.
- Suggested incident response, disaster recovery, and business continuity plans.
- Well defined incident response plan.
- Well tested and communicated incident response plan.
7. What is the current security prowess?
- No security expertise.
- Training to develop expertise among resources.
- A couple of in-house security experts.
- Significant certified security experts on staff.
8. What do your conversations around security look like?
- We discuss it as it comes up.
- I am initiating security conversations more frequently.
- I have regularly scheduled security conversations.
- Security conversations are required monthly.
9. What minimum cybersecurity standards do you require?
- None.
- Recommended minimum requirements.
- Expected standards
- Required standards.