Is there a designated cybersecurity officer or team responsible for risk management?

Do you use user behavior analytics to detect potentially malicious activity?

Do you have arrangements with external cybersecurity firms for additional support during an incident?

Are advanced workshops or training sessions provided for the staff on specific cybersecurity threats and countermeasures?

Are regular, detailed cybersecurity incident simulations conducted to test readiness?

Are recovery time objectives (RTOs) defined, communicated, and tested for critical IT systems?

Do you regularly evaluate the effectiveness of cybersecurity training programs?

Are post-incident reviews conducted to analyze the response and identify areas for improvement?

Do you have legal counsel to manage the reporting of cybersecurity incidents as per regulatory requirements?

Are all cybersecurity policies, procedures, and compliance measures well-documented and accessible?

Is a Data Protection Officer (DPO) appointed to ensure compliance with data protection laws and regulations?

Is there a process in place for continual improvement of risk management strategies based on new threats and vulnerabilities?

Is your security architecture periodically reviewed and updated to reflect current cybersecurity practices and threats?

Do you have a communication plan in place for coordinating with external stakeholders during a cybersecurity incident?

Do you continuously monitor and review the security practices of your suppliers and third-party service providers?

Are stakeholders regularly involved in identification, assessment and management of risk?

Are escalation procedures clearly defined and known to all relevant staff for different types of security incidents and initial evaluation of the severity?

Do you conduct interdependency analyses to understand how disruptions to one system or process could affect others?

Are cybersecurity training programmes tailored to employees' specific roles and responsibilities?

Are business continuity plans tested under different scenarios to check their effectiveness in various potential incidents?

Is there formal agreement clauses in place that require suppliers to report security incidents?

Do you conduct regular business impact analyses to determine critical systems and data essential for your organization’s continuity?

Do you regularly test employees with simulated phishing attacks to enhance their vigilance?

Is there a dedicated function or team monitoring changes in cybersecurity regulations and ensuring compliance?

Are cybersecurity risk management processes integrated with the overall risk management framework in the organization?

Do you have specific plans for managing cybersecurity incidents that involve your supply chain?

Are employees trained on the legal aspects of cybersecurity, including the requirements for privacy, data and information protection including the NIS directive as well?

Do you have audit rights included in agreements with key suppliers to ensure compliance with your security requirements?

Is there a formal mechanism for incorporating feedback from audits and incidents into the risk management process?

Is there an effective mechanism in place for employees to report cybersecurity concerns or incidents?

Are business continuity plans updated based on lessons learned from actual incidents?

Are you implementing or planning to implement a Zero Trust security model?

Do you employ advanced threat detection technologies to identify potential cybersecurity threats?

Are relevant staff encouraged or required to obtain cybersecurity certifications?

Are minimum cybersecurity standards defined and enforced for all suppliers and third-party service providers?

Do you adopt and adapt emerging technologies to enhance risk management processes?

Is there a dedicated incident response team with clearly defined roles and responsibilities?

Are systems and software regularly updated to address security vulnerabilities?

Do you maintain redundant infrastructure or services to ensure continuity in the event of a significant cybersecurity incident?

Are regular security assessments conducted by internal or external parties to identify vulnerabilities and/or do penetration testing?

Is supply chain risk management integrated into the overall organizational risk management framework?