Please provide your organisation legal name and registered details.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm whether your organisation has cyber insurance and provide provider/policy details if applicable.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please provide the main security/compliance contact responsible for this submission.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm whether any home-working devices are included in the scope of this assessment.

Present in: Danzel 3.3

Manual response required. Inventory and scoping evidence can be corroborated from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Expected supporting records may come from M365, NinjaOne, HaloPSA.

Please list the cloud services that are in scope for this assessment.

Present in: Danzel 3.3

Manual response required. Inventory and scoping evidence can be corroborated from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Expected supporting records may come from M365, NinjaOne, HaloPSA.

Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.

Present in: Danzel 3.3

Out-of-support operating systems detected via endoflife.date for A2.6: 22 Lenovo ThinkCentre M80s Gen 3 desktops running Windows 11 Professional 23H2 (cycle 11-23h2-w is out of support; supported version should be 10.0.22631 on a supported cycle).

22 Lenovo ThinkCentre M80s Gen 3 desktops running Windows 11 Professional 23H2; 24 Azure Virtual Desktop session host (Standard D8s v5) virtual desktops running Windows 11 Enterprise multi-session 23H2

Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.

Present in: Danzel 3.3

Out-of-support operating systems detected via endoflife.date for A2.7: 2 Supermicro SuperServer SYS-2029U-E1CR4T Proxmox VE host devices running Proxmox VE 8.2 (latest available version in supported cycle 8.x is 8.4).

6 Azure VM (Standard D4s v5) servers running Ubuntu Server 24.04 LTS; 2 Supermicro SuperServer SYS-2029U-E1CR4T Proxmox VE host hypervisors running Proxmox VE 8.2

Please confirm the security update process for in-scope systems and who owns it.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm the incident response/escalation process for security events in scope.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Do you have software firewalls enabled on all of your computers, laptops and servers?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

How is your firewall password configured?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

Do you have a process to manage your firewall?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

Are host firewalls enabled and configured to block unauthorized inbound network connections on supported endpoints?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

Are your boundary firewalls configured to allow access to their configuration settings over the internet?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

1 evidence item(s): NinjaOne-Demo (1).

Are systems and identities configured to an approved secure baseline with unnecessary features disabled?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Do you run or host external services that provide access to data (that should not be made public) to users across the internet?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Describe the process in place for changing passwords on your external services when you believe they have been compromised.

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Which method do you use to unlock the devices?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Please list your malware protection software.

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Please list all office applications that are used to create organisational data.

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Is unsupported or end-of-life software identified and remediated with accountable ownership?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Are all updates applied for operating systems by enabling auto updates?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Are all high-risk or critical security updates and vulnerability fixes for applications (including any associated files and extensions) installed within 14 days of release?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

Where auto updates are not being used, how do you ensure all high-risk or critical security updates of all applications are applied within 14 days of release?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

Are all your user and administrative accounts accessed by entering unique credentials?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Are administrative accounts separate from standard user accounts and used only for administrative tasks?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Do you formally track which users have administrator accounts in your organisation?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Please explain how you encourage people to use unique and strong passwords.

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Is multi-factor authentication enforced for privileged users and cloud service access?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is not yet implemented; remediation has been logged as an open action with the client.

No direct evidence items are currently mapped to this question.

Is anti-malware protection enabled on supported devices with current signatures and active monitoring?

Present in: Danzel 3.3

Evidence from M365-Demo, NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

2 evidence item(s): M365-Demo (1), NinjaOne-Demo (1).

If Option A has been selected: where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

If Option B has been selected: where you use an app-store or application signing, do you ensure users only install applications approved by your organisation and maintain that approved list?

Present in: Danzel 3.3

Evidence from M365-Demo, NinjaOne-Demo shows this control is not yet implemented; remediation has been logged as an open action with the client.

2 evidence item(s): M365-Demo (1), NinjaOne-Demo (1).