Cybersecurity Protection Assessment

Score

Some training is provided, but it is infrequent or lacks hands-on activities like phishing simulations

Comprehensive, ongoing training with regular updates and phishing awareness exercises

No guidelines provided; employees often use weak or repeated passwords

Some employees use strong passwords, but there is no consistent enforcement or guidance

Strong, unique passwords are required for all accounts, with policies in place to ensure regular updates and avoid reuse

No inventory is maintained for hardware or software

Inventory exists but is incomplete or not regularly updated

Comprehensive, regularly updated inventory covering all assets

Data is not classified; all data is treated the same

Data is classified, but protections (e.g., encryption or access controls) are not consistently applied

Data is fully classified (e.g., confidential, internal, public) with strong protections in place, like encryption and access controls

No malware protection or outdated software in use

Basic antivirus software is installed but lacks advanced features or integration into incident response processes

A managed antivirus solution with 24/7 monitoring, a dedicated incident response team, and established SOPs to handle malware incidents effectively

No access controls in place; sensitive data can be accessed by anyone

Some controls exist but are not fully enforced or lack advanced security like multi-factor authentication

Access is strictly managed with role-based permissions and multi-factor authentication

Systems use default settings, including default passwords, with no security measures in place

Some security settings are applied (e.g., passwords are changed, unnecessary features are disabled), but not consistently across all systems

Systems are fully secured with detailed guidelines, regular checks, and automated tools to maintain safe configurations

Rarely or never updated; many systems run on outdated software

Some systems are updated, but others remain outdated due to inconsistent practices

All systems are updated promptly, often automatically, with strict policies in place

No backups are performed, or backups are stored in insecure locations

Backups are performed but not regularly tested for usability or stored securely

Automated backups are performed frequently, tested regularly, and stored securely (e.g., offline or encrypted cloud)