Do you have software firewalls enabled on all of your computers, laptops and servers?

When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default pass…

How is your firewall password configured?

Do you have a process to manage your firewall?

Are host firewalls enabled and configured to block unauthorized inbound network connections on supported endpoints?

Are your boundary firewalls configured to allow access to their configuration settings over the internet?

If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trus…

Are systems and identities configured to an approved secure baseline with unnecessary features disabled?

Do you run or host external services that provide access to data (that should not be made public) to users across the internet?

Describe the process in place for changing passwords on your external services when you believe they have been compromised.

Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?

Which method do you use to unlock the devices?

Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?

Please list your malware protection software.

Please list all office applications that are used to create organisational data.

Is unsupported or end-of-life software identified and remediated with accountable ownership?

Are all updates applied for operating systems by enabling auto updates?

Are all updates applied on your applications by enabling auto updates?

Are your users only provided with user accounts after a process has been followed to approve their creation? Describe the process.

How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?

Do you have a formal process for giving someone access to systems at an administrator level and can you describe this process?

How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?

Do you review who should have administrative access on a regular basis?

Which technical controls are used to manage the quality of your passwords within your organisation?

Do you have a process for when you believe the passwords or accounts have been compromised?

If you have answered no to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.

Has MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?

Are malware detections investigated and resolved through a documented incident workflow?

If Option B has been selected: where you use an app-store or application signing, do you ensure users only install applications approved by your organ…