Quiz – Cybersecurity Risk Self-Assessment

Cybersecurity Risk Self-Assessment

How much cybersecurity risk is in your org?

Not for Profits are so missioned-focussed that they often take their underlying IT infrastructure for granted when making decisions about budget, resources and/or policies. That is…until there’s an incident or issue.

Take my Free Cybersecurity Risk Self-Assessment that will help you understand where the most common risks lie in your IT infrastructure. It’s only 11 multiple-choice questions, and you’ll get your results right away.

Name*
First Name
Email*

Q1: Do you know where every organisation’s PC, laptop and phone is?*
- (A) I think so. Our CFO has an asset register.
- (B) To be honest, I’m not sure
- (C) Probably not. There’s no one assigned to manage this.
- (D) Yes, our IT manager has a detailed asset register, and we review this regularly.

Q2: What version of the Windows operating model is on ALL your laptops and desktops?*
- (A) It ranges based when we bought them.
- (B) Windows 10 or 11. We just had a refresh of all our devices in the last two years.
- (C) I’m not sure. We haven’t tracked this.
- (D) It’s a mix of Windows 8 and 10.

Q3: Where is your data stored?*
- (A) Mostly in servers in our building.
- (B) We keep a lot of pdf or paper forms stored in filing cabinets and emails.
- (C) Everything is virtually stored to the cloud with remote back-up too. The usual firewalls and security settings are in place.
- (D) I’m not sure.

Q4: How much spam do you receive to your work emails?*
- (A) It tends to go up and down on a regular basis.
- (B) It’s a constant struggle. Some days I feel like I get more spam than normal emails.
- (C) Not many. Our IT team shuts it down quickly whenever there’s an issue.
- (D) Not sure. I just ignore them.

Q5: How do your software developers test new code before making it live?*
- (A) Don’t know. We outsource everything.
- (B) I’m not sure. We just put in a request and then I can see it on the website (or systems).
- (C) We do user testing before something goes live, but I’m not sure about anything else.
- (D) Our IT manager handles this, and I know we do monthly releases for most systems and websites unless it’s urgent.

Q6: How do you manage passwords?*
- (A) Users are automatically asked to change their passwords on a regular basis for all systems we use.
- (B) Not sure.
- (C) Users are automatically asked to change their passwords on a regular basis for the systems we host internally, but I’m not sure about the applications that are hosted by others.
- (D) We have single sign-on for all applications the staff use and multi-factor authentication if the device is not known already.

Q7: What apps are your staff using at work that they installed themselves or were not authorised.*
- (A) They’re using other apps?
- (B) Anything they need to get their jobs done. We don't track this generally.
- (C) I know they’re using some free tools like Trello and Grammerly.
- (D) None. Staff are not given admin rights to install apps, and we have a pre-approved “trusted” list of apps they can use via their authorised browser.

Q8: How often is one of your IT systems or websites not working?*
- (A) There’s one or two systems/websites that seem to go down a lot, but the others are usually fine.
- (B) Too often. I feel like we’re always fighting fires.
- (C) Sometimes. But when one goes down, all work stops.
- (D) Rare, but when it happens, we seem to get it up fairly quickly.

Q9: What kind of data security policies do you have in place for staff?*
- (A) It’s in all the other policies that staff have to sign when they first join the organisation.
- (B) It’s in the policies, and we do a mandatory refresher on a semi-annual basis.
- (C) We have policies in place and do refreshers, but we still have regular issues.
- (D) I’m not sure.

Q10: Which staff have access to your data?*
- (A) Every system has been configured with role-based access to data. Information is only available on a “need to know” basis.
- (B) We believe in being an open organisation. All staff have access to the same info.
- (C) I’m not sure.
- (D) It’s a mix. Sometimes we restrict info to staff and other times we don’t. It really depends on the system.

Q11: Do you require Multi-verification for any Admin accounts?*
- (A) Yes
- (B) No

Exit mobile version