Please provide your organisation legal name and registered details.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm whether your organisation has cyber insurance and provide provider/policy details if applicable.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please provide the main security/compliance contact responsible for this submission.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm whether any home-working devices are included in the scope of this assessment.

Present in: Danzel 3.3

Manual response required. Inventory and scoping evidence can be corroborated from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Expected supporting records may come from M365, NinjaOne, HaloPSA.

Please list the cloud services that are in scope for this assessment.

Present in: Danzel 3.3

Manual response required. Inventory and scoping evidence can be corroborated from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Expected supporting records may come from M365, NinjaOne, HaloPSA.

Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.

Present in: Danzel 3.3

Out-of-support operating systems detected via endoflife.date for A2.6: 25 Microsoft Surface Laptop 5 laptops running Windows 11 Professional 23H2 (cycle 11-23h2-w is out of support; supported version should be 10.0.22631 on a supported cycle); 12 Lenovo ThinkCentre M90q Gen 3 desktops running Windows 10 Professional 22H2 (Windows 10 is out of support; supported version should be Windows 11 24H2 or later).

10 Apple MacBook Pro 14-inch (M2 Pro) laptops running macOS Ventura 13; 25 Microsoft Surface Laptop 5 laptops running Windows 11 Professional 23H2; 12 Lenovo ThinkCentre M90q Gen 3 desktops running Windows 10 Professional 22H2; 18 Azure Virtual Desktop session host (Standard D4s v5) virtual desktops running Windows 11 Enterprise 23H2

Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.

Present in: Danzel 3.3

Some operating systems in A2.7 could not be lifecycle-validated from endoflife.date cycles: 3 Dell PowerEdge R740 ESXi host devices running VMware ESXi 8.0 Update 2.

8 Lenovo ThinkSystem SR650 V2 servers running Windows Server 2022; 14 Dell PowerEdge R740 virtual machine virtual servers running Windows Server 2019; 3 Dell PowerEdge R740 ESXi host hypervisors running VMware ESXi 8.0 Update 2; 2 Azure Virtual Desktop host (Dell PowerEdge R650) VDI servers running Windows Server 2022

Please confirm the security update process for in-scope systems and who owns it.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Please confirm the incident response/escalation process for security events in scope.

Present in: Danzel 3.3

Manual response required. Supporting records can be corroborated from HaloPSA, M365, NinjaOne where available.

No direct mapped evidence yet. Supporting records may be available from HaloPSA, M365, NinjaOne.

Do you have software firewalls enabled on all of your computers, laptops and servers?

Present in: Danzel 3.3

Evidence from M365-Intune-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices?

Present in: Danzel 3.3

Verified configuration evidence from M365-Intune-Demo, NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

How is your firewall password configured?

Present in: Danzel 3.3

No conclusive evidence has been returned from M365-Intune-Demo, NinjaOne-Demo for this control; manual verification is recommended.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

Do you have a process to manage your firewall?

Present in: Danzel 3.3

Evidence from M365-Intune-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

Are host firewalls enabled and configured to block unauthorized inbound network connections on supported endpoints?

Present in: Danzel 3.3

Verified configuration evidence from M365-Intune-Demo, NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

Are your boundary firewalls configured to allow access to their configuration settings over the internet?

Present in: Danzel 3.3

No conclusive evidence has been returned from M365-Intune-Demo, NinjaOne-Demo for this control; manual verification is recommended.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

If you answered yes in question A4.9, is the access to your firewall settings protected by either multi-factor authentication or by only allowing trusted IP addresses combined with managed authentication to access the settings?

Present in: Danzel 3.3

Evidence from M365-Intune-Demo, NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

2 evidence item(s): M365-Intune-Demo (1), NinjaOne-Demo (1).

Are systems and identities configured to an approved secure baseline with unnecessary features disabled?

Present in: Danzel 3.3

Verified configuration evidence from NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

1 evidence item(s): NinjaOne-Demo (1).

Do you run or host external services that provide access to data (that should not be made public) to users across the internet?

Present in: Danzel 3.3

No conclusive evidence has been returned from NinjaOne-Demo for this control; manual verification is recommended.

1 evidence item(s): NinjaOne-Demo (1).

Describe the process in place for changing passwords on your external services when you believe they have been compromised.

Present in: Danzel 3.3

Evidence from NinjaOne-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

1 evidence item(s): NinjaOne-Demo (1).

Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?

Present in: Danzel 3.3

Verified configuration evidence from NinjaOne-Demo confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

1 evidence item(s): NinjaOne-Demo (1).

Which method do you use to unlock the devices?

Present in: Danzel 3.3

No conclusive evidence has been returned from the connected data sources for this control; manual verification is recommended.

No direct evidence items are currently mapped to this question.

Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.

Please list your malware protection software.

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Please list all office applications that are used to create organisational data.

Present in: Danzel 3.3

No conclusive evidence has been returned from the connected data sources for this control; manual verification is recommended.

No direct evidence items are currently mapped to this question.

Is unsupported or end-of-life software identified and remediated with accountable ownership?

Present in: Danzel 3.3

Evidence from HaloPSA-Demo, M365-Intune-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

2 evidence item(s): HaloPSA-Demo (1), M365-Intune-Demo (1).

Are all updates applied for operating systems by enabling auto updates?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Are all high-risk or critical security updates and vulnerability fixes for applications (including any associated files and extensions) installed within 14 days of release?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

Where auto updates are not being used, how do you ensure all high-risk or critical security updates of all applications are applied within 14 days of release?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

Are all your user and administrative accounts accessed by entering unique credentials?

Present in: Danzel 3.3

No conclusive evidence has been returned from the connected data sources for this control; manual verification is recommended.

No direct evidence items are currently mapped to this question.

Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.

Are administrative accounts separate from standard user accounts and used only for administrative tasks?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Do you formally track which users have administrator accounts in your organisation?

Present in: Danzel 3.3

No conclusive evidence has been returned from the connected data sources for this control; manual verification is recommended.

No direct evidence items are currently mapped to this question.

Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?

Present in: Danzel 3.3

Evidence from the connected data sources shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

No direct evidence items are currently mapped to this question.

Please explain how you encourage people to use unique and strong passwords.

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

Is multi-factor authentication enforced for privileged users and cloud service access?

Present in: Danzel 3.3

No conclusive evidence has been returned from M365-Demo for this control; manual verification is recommended.

1 evidence item(s): M365-Demo (1).

Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?

Present in: Danzel 3.3

Evidence from M365-Demo shows this control is partially in place: some configuration is correct, but gaps remain before the requirement is fully met.

1 evidence item(s): M365-Demo (1).

Is anti-malware protection enabled on supported devices with current signatures and active monitoring?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.

If Option A has been selected: where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?

Present in: Danzel 3.3

Manual response required. Corroborating records may be available from M365, NinjaOne, HaloPSA.

No direct mapped evidence yet. Supporting records may be available from M365, NinjaOne, HaloPSA.

If Option B has been selected: where you use an app-store or application signing, do you ensure users only install applications approved by your organisation and maintain that approved list?

Present in: Danzel 3.3

Verified configuration evidence from the connected data sources confirms this control is fully implemented, with no outstanding non-conformities from the latest assessment cycle.

No direct evidence items are currently mapped to this question.