← All readiness checks
Answer for where you are today. "Not sure" is a fine answer: it shows up as something to find out.
1. Have you defined which product, systems, people and data are in scope?
2. Are your security policies written, approved by leadership and reviewed at least yearly?
3. Is a named person accountable for security and compliance?
4. Do you run a risk assessment at least yearly and keep a risk register?
5. Does each risk have an owner and a treatment plan?
6. Is multi-factor authentication enforced for staff on production systems and key SaaS?
7. Do you review user access on a schedule and keep evidence of the reviews?
8. Is access removed promptly when people leave or change roles?
9. Are code and infrastructure changes reviewed and approved before production?
10. Are development and production environments separated?
11. Do you centralize logs and alert on security events?
12. Do you scan for vulnerabilities and patch on a defined schedule?
13. Do you have an incident response plan that has been tested?
14. Are backups restore-tested, with a continuity plan in place?
15. Do you keep a vendor inventory and review vendors' security (for example their SOC 2 reports)?
16. Do all staff complete security awareness training, with background checks where lawful?
17. Could you show evidence (tickets, logs, screenshots) that controls ran over the past months?
See my readiness score