88-question enterprise cybersecurity self-assessment

Assign owners, document critical operations and open risks, and set review dates.

1. Is an owner assigned to cybersecurity decisions?
2. Are the IT systems supporting critical operations documented?
3. Is a risk register maintained and reviewed?
4. Has management approved a security policy?
5. Do improvement actions have owners and deadlines?
6. Are major system changes subject to approval?
7. Are security issues regularly reported to management?
8. Have applicable contractual, privacy and industry requirements been identified?

Update device, software and external-service inventories; prioritise unknown or unsupported assets.

9. Is there an inventory of computers, servers and network devices?
10. Are device owners and purposes recorded?
11. Are critical software products and versions inventoried?
12. Are systems that no longer receive security updates identified?
13. Are company domains, websites and public IP addresses inventoried?
14. Is there a process for handling unauthorised connected devices?
15. Are software licences and installation sources checked?
16. Is secure data removal verified before equipment disposal?

Prioritise administrator and remote accounts, remove unused access and review MFA.

17. Does each staff member use an individually attributable account?
18. Are administrator accounts separate from everyday accounts?
19. Is multi-factor authentication enabled for administrator sign-in?
20. Is MFA enabled for remote and cloud sign-in?
21. Is access limited to what each role needs?
22. Is access promptly adjusted when staff leave or change roles?
23. Are unused and unknown accounts regularly disabled?
24. Do service accounts and keys have owners and rotation arrangements?

Review exposed management interfaces, segmentation and firewall rules; restrict unnecessary connections.

25. Is an up-to-date network and segmentation diagram maintained?
26. Are firewall rule purposes and owners reviewed regularly?
27. Are management interfaces restricted to trusted networks or controlled access?
28. Is guest Wi-Fi isolated from internal systems?
29. Are critical servers appropriately separated from user networks?
30. Do remote support sessions require approval and retain records?
31. Are unnecessary public services and ports restricted?
32. Are network configuration changes and unusual connections monitored?

Prioritise patches by risk and review protection coverage and failed updates.

33. Are company computers covered by centrally managed endpoint protection?
34. Are devices with inactive protection investigated?
35. Are applicable security update notices reviewed regularly?
36. Are patches prioritised by risk and external exposure?
37. Do critical updates have testing and rollback arrangements?
38. Is successful installation verified rather than only deployment?
39. Is disk encryption used on laptops and portable devices?
40. Is users' installation of high-risk software restricted?

Map sensitive data, access and retention periods, and restrict public sharing.

41. Have sensitive customer, staff and business data been identified?
42. Are sensitive-data storage locations recorded?
43. Are access restrictions based on data sensitivity?
44. Are public and external sharing links reviewed regularly?
45. Is appropriate encryption used for sensitive-data transfers?
46. Are data retention and deletion arrangements defined?
47. Is sensitive-data transfer through USB or personal cloud services restricted?
48. Is someone responsible for personal-data requests and incidents?

Verify restoration of critical systems and protect backup accounts and isolated copies.

49. Are systems and data requiring backup listed?
50. Are acceptable data-loss and downtime targets defined?
51. Are failed backups monitored and followed up?
52. Are offline, immutable or appropriately isolated copies maintained?
53. Are backup administration accounts independently protected?
54. Are file and system restores tested in practice?
55. Is restored data usable and recovery timing checked against targets?
56. Are recovery instructions usable when key staff are unavailable?

Review supplier access, data regions and responsibilities, and plan for outage or exit.

57. Is there an inventory of enterprise SaaS and cloud services?
58. Are supplier security arrangements assessed before procurement?
59. Are supplier and enterprise security responsibilities documented?
60. Is supplier remote access time-limited and restricted?
61. Are cloud data storage and processing regions checked?
62. Are cloud sharing and public-access settings reviewed regularly?
63. Are supplier incident contacts known?
64. Are there exit arrangements for data export or service migration?

Map AI data flows and tool permissions; test access boundaries and human approval for consequential actions.

65. Are staff-used AI services and agents known?
66. Are rules defined for data that may be entered into AI tools?
67. Are model, document-processing and external API data flows reviewed?
68. Does knowledge retrieval respect staff access permissions?
69. Do agent tools receive only the permissions they need?
70. Do consequential actions require human approval and traceable records?
71. Are prompt injection and sensitive-data disclosure risks tested?
72. Are there arrangements to stop agents, revoke keys and reverse actions?

Assign alert owners and practise isolation, evidence preservation, notification and recovery.

73. Do critical systems retain sign-in and administration logs?
74. Are log timestamps synchronised and retention periods appropriate?
75. Are people assigned to triage alerts and escalate incidents?
76. Is an incident contact list maintained with backup contacts?
77. Are there instructions for isolating affected devices?
78. Is there a process to preserve logs and other incident evidence?
79. Are notification recipients and deadlines mapped to applicable requirements?
80. Have incident exercises been conducted and improvements followed up?

Use short exercises and clear reporting routes to improve staff, device and payment-verification practices.

81. Do staff receive cybersecurity training relevant to their roles?
82. Do staff know whom to contact about suspicious email?
83. Are payment or bank-detail changes verified through an independent channel?
84. Do exercises check recognition and reporting of suspicious messages?
85. Is physical access to server rooms and critical equipment restricted?
86. Are reporting and disablement procedures in place for lost devices?
87. Are staff required to lock screens when leaving their desks?
88. Are gaps in training, exercises and daily operations reviewed regularly?