Do you conduct regular business impact analyses to determine critical systems and data essential for your organization’s continuity?

Is there a process in place for continual improvement of risk management strategies based on new threats and vulnerabilities?

Is there a dedicated incident response team with clearly defined roles and responsibilities?

Do you maintain redundant infrastructure or services to ensure continuity in the event of a significant cybersecurity incident?

Do you have a communication plan in place for coordinating with external stakeholders during a cybersecurity incident?

Are post-incident reviews conducted to analyze the response and identify areas for improvement?

Do you have legal counsel to manage the reporting of cybersecurity incidents as per regulatory requirements?

Are business continuity plans updated based on lessons learned from actual incidents?

Are employees trained on the legal aspects of cybersecurity, including the requirements for privacy, data and information protection including the NIS directive as well?

Are systems and software regularly updated to address security vulnerabilities?

Are minimum cybersecurity standards defined and enforced for all suppliers and third-party service providers?

Are regular security assessments conducted by internal or external parties to identify vulnerabilities and/or do penetration testing?

Are stakeholders regularly involved in identification, assessment and management of risk?

Are you implementing or planning to implement a Zero Trust security model?

Is there an effective mechanism in place for employees to report cybersecurity concerns or incidents?

Are relevant staff encouraged or required to obtain cybersecurity certifications?

Are advanced workshops or training sessions provided for the staff on specific cybersecurity threats and countermeasures?

Do you use user behavior analytics to detect potentially malicious activity?

Do you regularly test employees with simulated phishing attacks to enhance their vigilance?

Do you have arrangements with external cybersecurity firms for additional support during an incident?

Is a Data Protection Officer (DPO) appointed to ensure compliance with data protection laws and regulations?

Are cybersecurity risk management processes integrated with the overall risk management framework in the organization?

Is there a dedicated function or team monitoring changes in cybersecurity regulations and ensuring compliance?

Do you adopt and adapt emerging technologies to enhance risk management processes?

Is supply chain risk management integrated into the overall organizational risk management framework?

Do you regularly evaluate the effectiveness of cybersecurity training programs?

Do you continuously monitor and review the security practices of your suppliers and third-party service providers?

Is there formal agreement clauses in place that require suppliers to report security incidents?

Do you have audit rights included in agreements with key suppliers to ensure compliance with your security requirements?

Do you employ advanced threat detection technologies to identify potential cybersecurity threats?

Are escalation procedures clearly defined and known to all relevant staff for different types of security incidents and initial evaluation of the severity?

Do you conduct interdependency analyses to understand how disruptions to one system or process could affect others?

Are cybersecurity training programmes tailored to employees' specific roles and responsibilities?

Do you have specific plans for managing cybersecurity incidents that involve your supply chain?

Is your security architecture periodically reviewed and updated to reflect current cybersecurity practices and threats?

Is there a formal mechanism for incorporating feedback from audits and incidents into the risk management process?

Are regular, detailed cybersecurity incident simulations conducted to test readiness?

Are all cybersecurity policies, procedures, and compliance measures well-documented and accessible?

Are business continuity plans tested under different scenarios to check their effectiveness in various potential incidents?

Is there a designated cybersecurity officer or team responsible for risk management?

Are recovery time objectives (RTOs) defined, communicated, and tested for critical IT systems?