ISO-Questions | GIS-Consulting Shop

Welcome to the ISO domain questionnaire: (click next to go to the questions)

Access control

Do you need to change your corporate password minimum every 40 days?

Yes No

Access control

Did your IT consult your DPO (Data Protection Officer) about using biometrics for authentication purposes before the implementation of the solution?

Yes No

Access control

Do you use Single-Sign-On (i.e.. you need to enter only once your credentials and then you can access all your applications)?

Yes No

Access control

Is it HR that is responsible for centrally triggering your on- and offboarding?

Yes No

Access control

Is the turnover of your personnel higher than 15%?

Yes No

Access control

Did you have in the past 15 months an incident that led to data lost (breached)?

Yes No

Access control

Is access management administered (assigning user permissions within the application) by your business departments?

Yes No

Access control

Your marketing department wants to have a view on your website visits (gender, location, device type), so they ask IT to get the statistics. They argue they need to know ad-hoc because the CEO asked for it. Is it OK for IT to deliver it?

Yes No

Document management

Have you ever read your documents on logical access, change and incident management? Do you know where you can find them within your organisation?

Yes No

Document management

Is the following statement correct? "Changes should be managed in a controlled way."

Add description here!

Yes No

Document management

Is the following statement correct? "You do not need detailed, written procedures for areas like access management, change management and incident management, because your people know how the processes work."

Yes No

Document management

A control definition should be simple and short, but descriptive enough. Based on the above statement do you find the below control definition appropriate: "Changes need to be tested."

Yes No

Network security

The most important technical device that protects your organisation from internet attacks is a router.

Yes No

Network security

Does IT network security include physical access?

Yes No

Network security

Can you and your employees access company applications and data from private devices (not issued by your company)?

Yes No

Network security

Is it true that a firewall is a very thick wall that withholds the fire.

Yes No

Network security

Have your organisation performed a penetration test on your network in the last 3 years?

Yes No

Network security

Can you turn off your anti-virus system on your corporate PC/laptop?

Yes No

Network security

Do you have a secure dedicated area where you store in an organised fashion your IT system configuration documentation? Do you know where that place is?

Yes No

Human resource security

Do you check employment history of your employees with their previous employers? Do you check their criminal backgrounds?

Yes No

Human resource security

Do you have a disciplinary process and do you make your employees confirm they read and understood it?

Yes No

Human resource security

Do you have a training budget reserved so that your technical people can follow at least 1 training a year?

Yes No

Human resource security

Did you have a security awareness training in the last 12 months?

Yes No

Human resource security

Do you know with confidence if your organisation has no user accounts active for employees and contractors who have left the organisation?

Yes No

Organization of information security

Do you have a security officer?

Yes No

Organization of information security

Does you security office have other operational responsibility?

Yes No

Organization of information security

Are you concerned about what your security officer does (whether he brings value to the table)?

Yes No

Organization of information security

Does your security officer report to IT Manager (CIO)?

Yes No

Asset management

Do you feel security is too much in your organisation?

Yes No

Asset management

Is knowing the IT assets critical for IT security?

Yes No

Asset management

Does your organisation have a central repository of IT assets that is complete?

Yes No

Asset management

Does your organisation automated mechanism to keep the asset repository up-to-date?

Yes No

Asset management

Do you consider the age and the available support when managing your IT assets?

Yes No

Physical and environmental security

Do you allow externals (guest, no contractors with permanent presence required) just to wander around on your company premises without them being escorted?

Yes No

Physical and environmental security

Do you have a badge reader on your data center / computer room?

Yes No

Physical and environmental security

Do you review (regularly, minimum yearly) the list of active cards allowing access to your premises and the data center / computer room?

Yes No

Physical and environmental security

Do you have in your organisation an access badge sharing practice? Or do you let people go through the badge reader controlled door when they do not badge?

Yes No

Physical and environmental security

Are each employees and contractors assigned with only one access badge?

Yes No

Operations security

Do you have your servers regularly (minimum quarterly) patched?

Yes No

Operations security

Do you apply secure baseline configuration on your servers and databases?

Yes No

Operations security

Do you monitor if the servers are up and running and are not overloaded?

Yes No

Operations security

Can you turn off anti-virus on your corporate laptop/desktop?

Yes No

Operations security

Have you been hit recently by a computer virus or a ransomware?

Yes No

System acquisition, development and maintenance

Do you have a baseline requirement set to assess software to acquire meeting basic security requirements of your organisation?

Yes No

System acquisition, development and maintenance

Do you have minimum 3 separate environments for each system where your organisation has custom built applications (development, user acceptance testing and production)?

Yes No

System acquisition, development and maintenance

Does business always perform user acceptance testing on changes of business nature (i.e. non-technical)?

Yes No

System acquisition, development and maintenance

Are your developers allowed to fix changes in the production environment?

Yes No

Supplier relationships

Do you have your security requirements covered in your contract with your suppliers?

Yes No

Supplier relationships

Do you review 3rd party audit reports or perform audits on your suppliers to confirm they have a secure operations?

Yes No

Supplier relationships

Do you measure service level delivery for your suppliers?

Yes No

Supplier relationships

Did you define in your contract with the service provider how data breaches should be handled and whose responsibility it is to report it to the Data Protection Authority?

Yes No

Information security incident management

Does your contract with your service provider have provisions that they should only make changes to the systems based on approved change tickets?

Yes No

Information security incident management

Do you have a formal incident management procedure in place?

Yes No

Information security incident management

Does your incident management procedure have requirements on how to handle security incidents?

Yes No

Information security incident management

Do you flag security related incidents with a special marker in your ticketing tool?

Yes No

Information security incident management

Does your security incident process involve the security officer and the Data Protection Officer subject to predefined set of criteria?

Yes No