Please provide your organisation legal name and registered details.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm whether your organisation has cyber insurance and provide provider/policy details if applicable.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please provide the main security/compliance contact responsible for this submission.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm whether any home-working devices are included in the scope of this assessment.

Present in: Danzel 3.3

Manual response required. Inventory and scoping evidence can be corroborated from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Expected supporting records may come from M365, NinjaOne, HaloPSA.

Please list the cloud services that are in scope for this assessment.

Present in: Danzel 3.3

Manual response required. Inventory and scoping evidence can be corroborated from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Expected supporting records may come from M365, NinjaOne, HaloPSA.

Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.

Present in: Danzel 3.3

Out-of-support operating systems detected via endoflife.date for A2.6: 16 Lenovo ThinkPad T14 Gen 4 laptops running Windows 11 Professional 23H2 (cycle 11-23h2-w is out of support; supported version should be 10.0.22631 on a supported cycle); 8 Lenovo ThinkCentre M70q Gen 3 desktops running Windows 10 Professional 22H2 (Windows 10 is out of support; supported version should be Windows 11 24H2 or later).

16 Lenovo ThinkPad T14 Gen 4 laptops running Windows 11 Professional 23H2; 8 Lenovo ThinkCentre M70q Gen 3 desktops running Windows 10 Professional 22H2

Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.

Present in: Danzel 3.3

All operating system versions in A2.7 are currently supported based on endoflife.date lifecycle data. Update insights: 4 HPE ProLiant DL360 Gen10 devices running Windows Server 2022 (installed cycle 2022 is supported, but later supported cycle 2025 is available (latest 10.0.26100)); 9 Dell PowerEdge R640 virtual machine devices running Windows Server 2019 (installed cycle 2019 is supported, but later supported cycle 2025 is available (latest 10.0.26100)).

4 HPE ProLiant DL360 Gen10 servers running Windows Server 2022; 9 Dell PowerEdge R640 virtual machine virtual servers running Windows Server 2019

Please confirm the security update process for in-scope systems and who owns it.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm the incident response/escalation process for security events in scope.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Do you have software firewalls enabled on all of your computers, laptops and servers?

Present in: Danzel 3.3

No conclusive evidence has been returned from HaloPSA-Demo, NinjaOne-Demo for this control; manual verification is recommended.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?

Present in: Danzel 3.3

Evidence from HaloPSA-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

How is your firewall password configured?

Present in: Danzel 3.3

Verified configuration evidence from HaloPSA-Demo, NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

Do you have a process to manage your firewall?

Present in: Danzel 3.3

No conclusive evidence has been returned from HaloPSA-Demo, NinjaOne-Demo for this control; manual verification is recommended.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

Are host firewalls enabled and configured to block unauthorized inbound network connections on supported endpoints?

Present in: Danzel 3.3

Evidence from HaloPSA-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

Are your boundary firewalls configured to allow access to their configuration settings over the internet?

Present in: Danzel 3.3

Verified configuration evidence from HaloPSA-Demo, NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?

Present in: Danzel 3.3

No conclusive evidence has been returned from HaloPSA-Demo, NinjaOne-Demo for this control; manual verification is recommended.

2 evidence item(s): HaloPSA-Demo (1), NinjaOne-Demo (1).

Are systems and identities configured to an approved secure baseline with unnecessary features disabled?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.

Do you run or host external services that provide access to data (that should not be made public) to users across the internet?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Describe the process in place for changing passwords on your external services when you believe they have been compromised.

Present in: Danzel 3.3

No conclusive evidence has been returned from the connected data sources for this control; manual verification is recommended.

No direct evidence items are currently mapped to this question.

Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.

Which method do you use to unlock the devices?

Present in: Danzel 3.3

Verified configuration evidence from HaloPSA-Demo, M365-Intune-Demo, NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

3 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1), NinjaOne-Demo (1).

Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?

Present in: Danzel 3.3

No conclusive evidence has been returned from HaloPSA-Demo, M365-Intune-Demo, NinjaOne-Demo for this control; manual verification is recommended.

3 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1), NinjaOne-Demo (1).

Please list your malware protection software.

Present in: Danzel 3.3

Evidence from HaloPSA-Demo, M365-Intune-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

3 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1), NinjaOne-Demo (1).

Please list all office applications that are used to create organisational data.

Present in: Danzel 3.3

Verified configuration evidence from HaloPSA-Demo, M365-Intune-Demo, NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

3 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1), NinjaOne-Demo (1).

Is unsupported or end-of-life software identified and remediated with accountable ownership?

Present in: Danzel 3.3

No conclusive evidence has been returned from NinjaOne-Demo for this control; manual verification is recommended.

1 evidence item(s): NinjaOne-Demo (1).

Are all updates applied for operating systems by enabling auto updates?

Present in: Danzel 3.3

Evidence from HaloPSA-Demo, M365-Intune-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

3 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1), NinjaOne-Demo (1).

Are all high-risk or critical security updates and vulnerability fixes for applications (including any associated files and extensions) installed within 14 days of release?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

Where auto updates are not being used, how do you ensure all high-risk or critical security updates of all applications are applied within 14 days of release?

Present in: Danzel 3.3

Evidence from HaloPSA-Demo, M365-Intune-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

3 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1), NinjaOne-Demo (1).

Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

Are all your user and administrative accounts accessed by entering unique credentials?

Present in: Danzel 3.3

Verified configuration evidence from M365-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

1 evidence item(s): M365-Demo (1).

Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?

Present in: Danzel 3.3

No conclusive evidence has been returned from M365-Demo for this control; manual verification is recommended.

1 evidence item(s): M365-Demo (1).

Are administrative accounts separate from standard user accounts and used only for administrative tasks?

Present in: Danzel 3.3

Evidence from M365-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

1 evidence item(s): M365-Demo (1).

Do you formally track which users have administrator accounts in your organisation?

Present in: Danzel 3.3

Verified configuration evidence from M365-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

1 evidence item(s): M365-Demo (1).

Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?

Present in: Danzel 3.3

No conclusive evidence has been returned from M365-Demo for this control; manual verification is recommended.

1 evidence item(s): M365-Demo (1).

Please explain how you encourage people to use unique and strong passwords.

Present in: Danzel 3.3

Evidence from M365-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

1 evidence item(s): M365-Demo (1).

Is multi-factor authentication enforced for privileged users and cloud service access?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?

Present in: Danzel 3.3

No conclusive evidence has been returned from the connected data sources for this control; manual verification is recommended.

No direct evidence items are currently mapped to this question.

Is anti-malware protection enabled on supported devices with current signatures and active monitoring?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.

If Option A has been selected: where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

If Option B has been selected: where you use an app-store or application signing, do you ensure users only install applications approved by your organisation and maintain that approved list?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.