Cybersecurity Self-Assessment

Not in place means that there is sporadic or no evidence of these programs and there little or no documentation to show for.
Partially in place means that awareness and training is being done, however there is little documentation to ensure quality and consistency.
Mostly in place means that training and awareness is being done as good as across the organization and it is documented, however there is room for improvement.
Fully in place means that training and awareness is being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no documented policy or procedure. And there are no designated roles defined and assigned to handle these incidents. And there are no reports to show for.
Partially in place means that there is a documented policy or procedure. Or there are designated roles defined and assigned to handle these incidents. Or, there are reports to show for.
Mostly in place means that there is a documented policy or procedure. And there are designated roles defined and assigned to handle these incidents. And there are reports to show for. However, there is room for improvement for all or some of these.
Fully in place means that there is a documented policy or procedure, there are designated roles defined and assigned to handle these incidents, there are reports to show for, and this is being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no centralized or shared inventory of authorized hardware. And there are no documented procedures to ensure the accuracy of this inventory and the tracking of the hardware assets. And there are no reports to show for.
Partially in place means that there is a documented procedure for hardware asset inventory management. Or there is a centralized or shared inventory of authorized hardware. Or, there are reports to show for.
Mostly in place means that there is a documented procedure for hardware asset inventory management. And there is a centralized or shared inventory of authorized hardware. And, there are reports to show for. However there is room for improvement for all or some of these.
Fully in place means that there is a documented procedure for hardware asset inventory management, there is a centralized or shared inventory of authorized hardware, there are reports to show for, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no centralized or shared inventory of authorized software. And there are no documented procedures to ensure the accuracy of this inventory and the tracking of the software assets. And there are no reports to show for.
Partially in place means that there is a documented procedure for software asset inventory management. Or there is a centralized or shared inventory of authorized software. Or, there are reports to show for.
Mostly in place means that there is a documented procedure for software asset inventory management. And there is a centralized or shared inventory of authorized software. And, there are reports to show for. However, there is room for improvement for all or some of these.
Fully in place means that there is a documented procedure for software asset inventory management, there is a centralized or shared inventory of authorized software, there are reports to show for, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no documented and communicated access control policy. And no documented procedures have been implemented to support the policy. And different account types have been not identified and selected. And no conditions for group and role membership have been established. And no approvals are required for requests to create or update information system accounts.
Partially in place means that there is a documented and communicated access control policy. Or there are documented procedures that have been implemented to support the policy. Or different account types have been not identified and selected. Or no conditions for group and role membership have been established. Or no approvals are required for requests to create or update information system accounts.
Mostly in place means that there is a documented and communicated access control policy. And there are documented procedures that have been implemented to support the policy. And different account types have been identified and selected. And conditions for group and role membership have been established. And approvals are required for requests to create or update information system accounts. However, there is room for improvement for all or some of these.
Fully in place means that there is a documented and communicated access control policy, there are documented procedures that have been implemented to support the policy, different account types have been identified and selected, conditions for group and role membership have been established, approvals are required for requests to create or update information system accounts, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no documented and communicated configuration management policy. And no documented procedures have been implemented to support the policy. And different change types have been not determined. And no change management tool has been employed to record and control changes to information systems. And no documented security configurations standards for operating systems and software are maintained.
Partially in place means that there is no documented and communicated configuration management policy. Or there are documented procedures that have been implemented to support the policy. Or different change types have not been determined. Or no change management tool has been employed to record and control changes to information systems. Or no documented security configurations standards for operating systems and software are maintained.
Mostly in place means that there is a documented and communicated configuration management policy. And there are documented procedures that have been implemented to support the policy. And different change types have been determined. And a change management tool has been employed to record and control changes to information systems. And documented security configurations standards for operating systems and software are maintained. However, there is room for improvement for all or some of these.
Fully in place means that there is a documented and communicated configuration management policy, there are documented procedures that have been implemented to support the policy, different change types have been determined, a change management tool has been employed to record and control changes to information systems, documented security configurations standards for operating systems and software are maintained, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no documented and communicated policy for maintaining, monitoring, and analyzing of audit logs. And no monitoring scope has been defined. And whether information systems have a capability to support the policy, has not been determined. And no local audit logging on all systems and network devices has been ensured.
Partially in place means that there is no documented and communicated policy for maintaining, monitoring, and analyzing of audit logs. Or no monitoring scope has been defined. Or whether information systems have a capability to support the policy, has not been determined. Or no local audit logging on all systems and network devices has been ensured.
Mostly in place means that there is a documented and communicated policy for maintaining, monitoring, and analyzing of audit logs. And a monitoring scope has been defined. And whether information systems have a capability to support the policy, has been determined. And local audit logging on all systems and network devices has been ensured. However, there is room for improvement for all or some of these.
Fully in place means that there is a documented and communicated policy for maintaining, monitoring, and analyzing of audit logs, that a monitoring scope has been defined, that whether information systems have a capability to support the policy, has been determined, that local audit logging on all systems and network devices has been ensured, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there is no documented and implemented plan for vulnerability management and assessments. And no tools have been deployed for automated vulnerability scanning and patch management for operating systems, as well as tools for software patch management. And back-to-back vulnerability scans are not being compared.
Partially in place means that there is no documented and implemented plan for vulnerability management and assessments. Or no tools have been deployed for automated vulnerability scanning or patch management for operating systems, or no tools for software patch management. Or back-to-back vulnerability scans are not being compared.
Mostly in place means that there is a documented and implemented plan for vulnerability management and assessments. And tools have been deployed for automated vulnerability scanning and patch management for operating systems, as well as tools for software patch management. And back-to-back vulnerability scans are being compared. However, there is room for improvement for all or some of these.
Fully in place means that there is a documented and implemented plan for vulnerability management and assessments. And tools have been deployed for automated vulnerability scanning and patch management for operating systems, as well as tools for software patch management. And back-to-back vulnerability scans are being compared, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that there are no documented internal standards for email and web browser protections to reduce the attack surface of common points of entry. And no cybersecurity vetting has been applied to all email client and web browser plug-ins. And no email spam filtering tools and tools to filter threat actor websites are being used.
Partially in place means that there are no documented internal standards for email and web browser protections to reduce the attack surface of common points of entry. Or no cybersecurity vetting has been applied to all email client and web browser plug-ins. Or no email spam filtering tools and tools to filter threat actor websites are being used.
Mostly in place means that there are documented internal standards for email and web browser protections to reduce the attack surface of common points of entry. And cybersecurity vetting has been applied to all email client and web browser plug-ins. And email spam filtering tools and tools to filter threat actor websites are being used. However, there is room for improvement for all or some of these.
Fully in place means that there are documented internal standards for email and web browser protections to reduce the attack surface of common points of entry. And cybersecurity vetting has been applied to all email client and web browser plug-ins. And email spam filtering tools and tools to filter threat actor websites are being used, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no malicious code protection mechanisms at information system entry and exit points have been deployed to detect and eradicate it. And no periodic malware scans of information systems are being performed. And no real-time malware scans are being performed of files from external sources when downloading them, opening them, and executing them.
Partially in place means that no malicious code protection mechanisms at information system entry and exit points have been deployed to detect and eradicate it. Or no periodic malware scans of information systems are being performed. Or no real-time malware scans are being performed of files from external sources when downloading them, opening them, and executing them.
Mostly in place means that malicious code protection mechanisms at information system entry and exit points have been deployed to detect and eradicate it. And periodic malware scans of information systems are being performed. And real-time malware scans are being performed of files from external sources when downloading them, opening them, and executing them. However, there is room for improvement for all or some of these.
Fully in place means that malicious code protection mechanisms at information system entry and exit points have been deployed to detect and eradicate it. And periodic malware scans of information systems are being performed. And real-time malware scans are being performed of files from external sources when downloading them, opening them, and executing them, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no baseline configuration control systems have been deployed that recognize changes to configuration baselines. And no scanning tools have been deployed to ensure that active ports, protocols, and services are authorized and operate within documented parameters. And no host-based firewall or port-filtering tools on end systems have been deployed to control traffic.
Partially in place means that no baseline configuration control systems have been deployed that recognize changes to configuration baselines. Or no scanning tools have been deployed to ensure that active ports, protocols, and services are authorized and operate within documented parameters. Or no host-based firewall or port-filtering tools on end systems have been deployed to control traffic.
Mostly in place means that baseline configuration control systems have been deployed that recognize changes to configuration baselines. And scanning tools have been deployed to ensure that active ports, protocols, and services are authorized and operate within documented parameters. And host-based firewall or port-filtering tools on end systems have been deployed to control traffic. However, there is room for improvement for all or some of these.
Fully in place means that baseline configuration control systems have been deployed that recognize changes to configuration baselines. And scanning tools have been deployed to ensure that active ports, protocols, and services are authorized and operate within documented parameters. And host-based firewall or port-filtering tools on end systems have been deployed to control traffic, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no data recovery capabilities have been implemented. And no regular and automated backups are performed. And not all backups have at least one offline destination. And these backups are not tested.
Partially in place means that no data recovery capabilities have been implemented. Or no regular and automated backups are performed. Or not all backups have at least one offline destination. Or these backups are not tested.
Mostly in place means that data recovery capabilities have been implemented. And regular and automated backups are performed. And all backups have at least one offline destination. And these backups are tested. However, there is room for improvement for all or some of these.
Fully in place means that data recovery capabilities have been implemented. And regular and automated backups are performed. And all backups have at least one offline destination. And these backups are tested, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no policies for secure configuration for network hardware, traffic rules and the management of network devices have been defined, documented, and communicated. And the management of network devices does not include multifactor authentication. And no procedures have been developed to support these policies, to protect and manage these network devices and to recognize any changes to them.
Partially in place means that no policies for secure configuration for network hardware, traffic rules and the management of network devices have been defined, documented, and communicated. Or the management of network devices does not include multifactor authentication. Or no procedures have been developed to support these policies, to protect and manage these network devices and to recognize any changes to them.
Mostly in place means that policies for secure configuration for network hardware, traffic rules and the management of network devices have been defined, documented, and communicated. And the management of network devices includes multifactor authentication. And procedures have been developed to support these policies, to protect and manage these network devices and to recognize any changes to them. However, there is room for improvement for all or some of these.
Fully in place means that policies for secure configuration for network hardware, traffic rules and the management of network devices have been defined, documented, and communicated. And the management of network devices includes multifactor authentication. And procedures have been developed to support these policies, to protect and manage these network devices and to recognize any changes to them, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no policies for secure boundary defenses have been defined, documented, and communicated. And no procedures have been developed to support these policies. And there are no controls in place regarding which individuals can access external information systems. And no controls are in place of which organization-controlled information can be processed, stored, or transmitted using external information systems.
Partially in place means that no policies for secure boundary defenses have been defined, documented, and communicated. Or no procedures have been developed to support these policies. Or there are no controls in place regarding which individuals can access external information systems. Or no controls are in place of which organization-controlled information can be processed, stored, or transmitted using external information systems.
Mostly in place means that policies for secure boundary defenses have been defined, documented, and communicated. And procedures have been developed to support these policies. And controls are in place regarding which individuals can access external information systems. And controls are in place of which organization-controlled information can be processed, stored, or transmitted using external information systems. However, there is room for improvement for all or some of these.
Fully in place means that policies for secure boundary defenses have been defined, documented, and communicated. And procedures have been developed to support these policies. And controls are in place regarding which individuals can access external information systems. And controls are in place of which organization-controlled information can be processed, stored, or transmitted using external information systems, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no policies for roles and responsibilities for data and media protection have been defined, documented, and communicated. And no organizational risk management policy has been applied to support these policies. And neither does the organizational risk management policy support the development of supporting procedures that protect information system media (digital and non-digital) until it is destroyed or sanitized.
Partially in place means that no policies for roles and responsibilities for data and media protection have been defined, documented, and communicated. Or no organizational risk management policy has been applied to support these policies. Or neither does the organizational risk management policy support the development of supporting procedures that protect information system media (digital and non-digital) until it is destroyed or sanitized.
Mostly in place means that policies for roles and responsibilities for data and media protection have been defined, documented, and communicated. And the organizational risk management policy has been applied to support these policies. And the organizational risk management policy supports the development of supporting procedures that protect information system media (digital and non-digital) until it is destroyed or sanitized. However, there is room for improvement for all or some of these.
Fully in place means that policies for roles and responsibilities for data and media protection have been defined, documented, and communicated. And the organizational risk management policy has been applied to support these policies. And the organizational risk management policy supports the development of supporting procedures that protect information system media (digital and non-digital) until it is destroyed or sanitized, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no policies and procedures for roles and responsibilities for controlled access have been defined, documented, and communicated. And no risk-based approach has been established to control access based on need to know and least privilege basis for access control to applications, data and, the network.
Partially in place means that no policies and procedures for roles and responsibilities for controlled access have been defined, documented, and communicated. Or no risk-based approach has been established to control access based on need to know and least privilege basis for access control to applications, data, and the network.
Mostly in place means that policies and procedures for roles and responsibilities for controlled access have been defined, documented, and communicated. And a risk-based approach has been established to control access based on need to know and least privilege basis for access control to applications, data, and the network. However, there is room for improvement for all or some of these.
Fully in place means that policies and procedures for roles and responsibilities for controlled access have been defined, documented, and communicated. And a risk-based approach has been established to control access based on need to know and least privilege basis for access control to applications, data, and the network, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no policies and procedures for roles and responsibilities for controlled wireless access have been defined, documented, and communicated. And no requirements and restrictions have been established for wireless implementation, connection, and configuration, and use and guidance.
Partially in place means that no policies and procedures for roles and responsibilities for controlled wireless access have been defined, documented, and communicated. Or no requirements and restrictions have been established for wireless implementation, connection, and configuration, and use and guidance.
Mostly in place means that policies and procedures for roles and responsibilities for controlled wireless access have been defined, documented, and communicated. And requirements and restrictions have been established for wireless implementation, connection, and configuration, and use and guidance. However, there is room for improvement for all or some of these.
Fully in place means that policies and procedures for roles and responsibilities for controlled wireless access have been defined, documented, and communicated. And requirements and restrictions have been established for wireless implementation, connection and configuration, and use and guidance, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no policies and procedures for roles and responsibilities for controlled account access and monitoring have been defined, documented, and communicated. And no accounts have been identified and selected that support or enable business functions.
Partially in place means that no policies and procedures for roles and responsibilities for controlled account access and monitoring have been defined, documented, and communicated. Or no accounts have been identified and selected that support or enable business functions.
Mostly in place means that policies and procedures for roles and responsibilities for controlled account access and monitoring have been defined, documented, and communicated. And accounts have been identified and selected that support or enable business functions. However, there is room for improvement for all or some of these.
Fully in place means that policies and procedures for roles and responsibilities for controlled account access and monitoring have been defined, documented, and communicated. And accounts have been identified and selected that support or enable business functions, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no secure coding and engineering practices (both in-house and external) for application software security have been defined, documented, and implemented. And no appropriate policy for 3rd party application software that ensures support has been defined, documented, and communicated. And there is no appropriate level of granularity for tracking and reporting in place to ensure the development and maintenance of secure application software.
Partially in place means that no secure coding and engineering practices (both in-house and external) for application software security have been defined, documented, and implemented. Or no appropriate policy for 3rd party application software that ensures support has been defined, documented, and communicated. Or there is no appropriate level of granularity for tracking and reporting in place to ensure the development and maintenance of secure application software.
Mostly in place means that secure coding and engineering practices (both in-house and external) for application software security have been defined, documented, and implemented. And an appropriate policy for 3rd party application software that ensures support has been defined, documented, and communicated. And there is an appropriate level of granularity for tracking and reporting is in place to ensure the development and maintenance of secure application software. However, there is room for improvement for all or some of these.
Fully in place means that secure coding and engineering practices (both in-house and external) for application software security have been defined, documented, and implemented. And an appropriate policy for 3rd party application software that ensures support has been defined, documented, and communicated. And there is an appropriate level of granularity for tracking and reporting is in place to ensure the development and maintenance of secure application software, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.

Not in place means that no secure assessment policy has been defined, documented, and communicated for penetration test and Red Team exercises, that establishes requirements, roles, responsibilities, procedures, management, and scope and coordination to enable one or more Red Teams to conduct assessments and penetration tests. And these Red Teams and penetration testing have not been authorized. And no security assessment plan has been developed.
Partially in place means that no secure assessment policy has been defined, documented, and communicated for penetration test and Red Team exercises, that establishes requirements, roles, responsibilities, procedures, management, and scope and coordination to enable one or more Red Teams to conduct assessments and penetration tests. Or these Red Teams and penetration testing have not been authorized. Or no security assessment plan has been developed.
Mostly in place means that a secure assessment policy has been defined, documented, and communicated for penetration test and Red Team exercises, that establishes requirements, roles, responsibilities, procedures, management, and scope and coordination to enable one or more Red Teams to conduct assessments and penetration tests. And these Red Teams and penetration testing have been authorized. And a security assessment plan has been developed. However, there is room for improvement for all or some of these.
Fully in place means that a secure assessment policy has been defined, documented, and communicated for penetration test and Red Team exercises, that establishes requirements, roles, responsibilities, procedures, management, and scope and coordination to enable one or more Red Teams to conduct assessments and penetration tests. And these Red Teams and penetration testing have been authorized. And a security assessment plan has been developed, and this is all being done across the organization in a consistent and quality manner, it is documented, and fully integrated in normal business practices.