Every interface your organisation has with the outside world is theoretically vulnerable to data breaches and cyber-attacks. These breaches and attacks can be damaging to your organisation, your clients, and your reputation. Dealing with the consequences and fixing the problem can be expensive and time-consuming. So, it’s worth thinking about how to protect your organisation.
Cyber security can be divided into 5 distinct domains, each requiring its own response. The table below can help you assess your organisation's response.
1. User access and authentication
Ensure only authorised people (users) have access to the organisation’s systems, applications, and data.
2. Information classification and security
How your organisation classifies and stores and handles its information, especially information that is sensitive, private, or confidential.
3. Device and network management
How all end-user devices (computers and mobile devices) and network equipment in your organisation are protected, managed, and monitored. This includes how your organisation’s networks are firewalled and protected with anti-phishing, antivirus and intrusion protection features and alerts for suspicious activity.
4. Policies, risk management, and compliance
An organisation’s cyber security policies, standards, and compliance processes ensure information security is managed and appropriately governed. It includes acceptable use of technology, incident response, testing schedules, and regulatory compliance.
5. User education
An organisation’s cyber security policies cover acceptable use of technology, incident response, staff education, testing schedules and regulatory compliance.
Category | Basic | Intermediate | Advanced |
---|---|---|---|
User access and authentication | We have:
|
We:
|
We use single sign-on to access important IT systems/applications (a secure, core authentication service). |
Information classification and security | We: • Considered data backup and configured as appropriate/where necessary for all important information stores. • Perform a simple data recovery test annually. |
We have: • Defined information categories (sensitive, confidential, public, etc.) and implemented (e.g. sensitive data is encrypted). • A system register that records approved information categories for each system. • Reliable and secure backups, and meet retention / recovery requirements. We perform a significant restore annually. |
Technical controls restrict staff from storing or transmitting sensitive data incorrectly. Data retention requirements are known and addressed in line with organisational needs and compliance obligations. |
Device and network management | We have:
|
User devices have appropriate, centrally monitored firewall & antivirus software. Sensitive information is securely encrypted & can be remote-wiped. Patch management is undertaken centrally. Critical patches are deployed rapidly. Perimeter firewall and Wi-Fi configuration minimises security risk. |
We:
|
Policies, risk management, and compliance | Policies cover staff obligations & organisational cyber security protections. A cyber security improvement plan exists. The executive reviews cyber security protections, risks, and issues at least twice annually. |
We have:
|
The organisation has been independently assessed and confirmed as compliant against an information security standard such as ISO/IEC 27001. |
User education |
We have:
|
Quizzes or phishing tests check knowledge annually. |
Training is engaging, tailored by role, available on demand & effective. A strong security culture exists – staff actively consider it their responsibility. |
Status message
Thanks for rating this guide.