Cybersecurity Self-Assessment

Assess your organisation’s cybersecurity resilience

Reveal your weaknesses with an instant report

Get an immediate insight into your organisation’s risk level with actionable steps towards stronger cybersecurity confidence.

"*" indicates required fields

Governance

Are you aware of your organisation’s cybersecurity posture as measured against a common framework such as the ACSC Essential 8, or NIST CSF?*

No awareness at all

I have occasional, informal conversations with the IT Manager about our cybersecurity posture

I receive regular updates from the IT team and/or risk compliance officer as to our cybersecurity posture

I have constant access to dashboards that are regularly updated showing our cybersecurity posture

We have been independently audited against a nominated standard within the last 12 months and have active programs in place to improve our cybersecurity posture with measurable metrics

Do you have visibility into your organisation’s cybersecurity risks, how likely they are to occur, their impact, and remediation actions?*

No visibility at all

I have occasional, informal conversations with the IT Manager and/or risk compliance officer about our cybersecurity risks

I’ve seen or am aware of a risk register that focuses on cybersecurity

Our cybersecurity risk register is regularly reviewed

Our cybersecurity risk register is regularly reviewed and is driven by automated tools (risk management platforms, vulnerability scans, etc)

Does your organisation have policies relating to managing cybersecurity that are widely known and understood by the key stakeholders?*

No such policies exist at all

I have occasional, informal conversations with the IT Manager and/or risk compliance officer about our Cybersecurity program, and Acceptable Use of ICT policies exist

Some Cybersecurity policies exist, but staff would struggle to know where they are located or their contents

Our Cybersecurity policies have been developed, with associated standards, but could do more work to ensure all staff are informed

A Cybersecurity steering group, or similar, reviews all policies on regular basis and ensures all relevant staff are notified of any material changes

Do you have a good handle on where your organisation sits within its supply chain and the priorities and mission for the organisation has been clearly communicated?*

No awareness at all

I have occasional, informal conversations with the IT Manager and/or risk compliance officer about our supply chain/third party risk

We may perform third party risk assessments on vendors/partners, but mostly in an ad-hoc fashion and/or for high budget projects

We regularly perform third party risk assessments on vendors/partners

Vendors and partners are regularly assessed, including at contract renewal time, and incorporated into our cybersecurity risk register

Is it clearly articulated who is responsible for cybersecurity in your organisation, and who is accountable?*

No such discussions have occurred

Isn’t the IT manager accountable for Cybersecurity?

There is an informal understanding that Cybersecurity accountability is at the executive/board level but has not been formally articulated and communicated

Policies exist that describe the ownership of Cybersecurity but has not been clearly articulated amongst all key stakeholders

Cybersecurity ownership has been clearly taken on by senior executives/board, with clearly defined roles and responsibilities communicated to all key stakeholders

People and Processes

Are your staff required to undergo regular Cybersecurity awareness training as part of their employment?*

No such training is in place

Occasional PDs are conducted in an informal and irregular manner

Security awareness training has been done an in ad hoc manner

At least annual training exercises amongst all staff, with training a mandatory requirement for new staff

At least annual training exercises amongst all staff, with training a mandatory requirement for new staff with reporting that shows our awareness trends over time

Do you have dedicated cybersecurity staff, or staff whose main role is managing Cybersecurity program(s), (ie, CISO, security engineer, etc)?*

No such dedicated staff, or cybersecurity not clearly defined as part of the role for existing staff

Cybersecurity has been articulated in one or two staff’s position description, but not much more beyond that

Cybersecurity roles have been clearly articulated amongst all key stakeholders, and documented, but Cybersecurity is but a part of their overall responsibility

We would regularly engage external cybersecurity services such as an MSSP and/or vCISO, but not on a full-time basis

Dedicated staff employed to manage the cybersecurity program

Are your policies, standards and procedures relating to Cybersecurity regularly reviewed, and any modifications communicated to the relevant staff?*

No reviews have been conducted (fire and forget)

Documentation is reviewed irregularly, with no or minimal evidence of such review activities

Documentation is regularly reviewed, but the review process is informal, and any changes are not typically well-communicated.

Documentation is reviewed via a formal process, changes are well-communicated, but there is minimal or no oversight of the implementation of any recommended changes

At least annual reviews from independent auditors, or a dedicated cybersecurity steering group, and changes are effectively communicated to all key stakeholders and monitored for effective implementation

How aware would you consider your staff be to spotting phishing emails or other social engineering actions?*

No awareness at all and will click on anything

Will most likely spot only the more obvious phishing emails, but still likely to click on most links and/or provide credentials to malicious forms

Will spot most phishing attempts but just ignore and/or not report the phishing email, or not know how to report it

Spots all but the most targeted phishing emails, and reports them according to established procedures

Phishing email Ninjas, more likely to send the emails than receive them

Incident Management

Is there a formal incident management plan in place that specifically relates to managing Cybersecurity incidents?*

No such plan exists for managing Cybersecurity incidents

We would use our general incident management plan, but it contains minimal to no guidance on responding to Cybersecurity incidents

Our general incident management plan does consider Cybersecurity incidents, but in a generalised, high-level manner

Specific mentions of the various Cybersecurity incidents exists within an incident management plan, but this mostly sits with the IT team

A formal incident management plan has been developed and communicated to all relevant key stakeholders

Does your organisation conduct any “lessons learnt” activities, or table-top scenario exercises to evaluate the incident management plan during staged exercises?*

No such activity takes place.

An informal awareness of how to respond to a Cybersecurity incident may exist with one or two key IT staff with minimal to no documentation, practice or debriefing conducted

Occasionally I get notified about some incident management training exercises being conducted, but mostly that’s left to the IT team

Incident management plan table-top scenario exercises are conducted and I’m informed of the results, but I’m not aware of any lesson learnt debriefs being conducted

The incident management plan mandates lessons learnt reviews, and regular table-top exercises are conducted, documented, and drive changes to the incident management plan via lessons learnt debriefs

Does your organisation have a disaster recovery plan that has been effectively communicated to all key stakeholders and is regularly reviewed and updated?*

No such plan exists

An informal awareness of how to recover from a disaster may exist with one or two key IT staff with minimal to no documentation

Some documentation exists but it’s accuracy and relevancy to be able to manage a disaster today is highly questionable

A formal DR plan exists, however its execution relies on one or two key (IT) staff members

A formal DR plan has been developed and communicated to all relevant key stakeholders and covers the current state of my organisation’s environment

Are you aware of any business impact assessments (BIA) that describe the various damaging Cybersecurity scenarios and their impact to your organisation?*

No such assessment has been conducted

An informal awareness of BIA may exist with one or two key IT staff with minimal to no documentation

Some documentation exists but the accuracy and relevancy are highly questionable

A formal BIA has been conducted but needs to be updated

Formal assessment has been developed and communicated to all relevant key stakeholders and accepted by the executive leadership. The BIA covers the current state of my organisation’s environment and is regularly reviewed to ensure it’s up to date.

Your Details

First name*

Last name*

Company*

Email*

Hidden

Total

Hidden

Calc Total

Comments

This field is for validation purposes and should be left unchanged.

Trusted by Australia’s leading schools and institutions

We have been trusted by almost 400 schools nationally to deliver the education IT platform they need safely and securely. Together, we help you build and operate the IT platform that can help your teachers and students realise their full potential, building a brighter future for all.

Learn more