Do you continuously monitor and review the security practices of your suppliers and third-party service providers?

Are all cybersecurity policies, procedures, and compliance measures well-documented and accessible?

Do you use user behavior analytics to detect potentially malicious activity?

Is supply chain risk management integrated into the overall organizational risk management framework?

Are regular security assessments conducted by internal or external parties to identify vulnerabilities and/or do penetration testing?

Are regular, detailed cybersecurity incident simulations conducted to test readiness?

Are cybersecurity training programmes tailored to employees' specific roles and responsibilities?

Is there a dedicated incident response team with clearly defined roles and responsibilities?

Is there a dedicated function or team monitoring changes in cybersecurity regulations and ensuring compliance?

Do you have audit rights included in agreements with key suppliers to ensure compliance with your security requirements?

Are relevant staff encouraged or required to obtain cybersecurity certifications?

Is there a process in place for continual improvement of risk management strategies based on new threats and vulnerabilities?

Is a Data Protection Officer (DPO) appointed to ensure compliance with data protection laws and regulations?

Do you regularly test employees with simulated phishing attacks to enhance their vigilance?

Are systems and software regularly updated to address security vulnerabilities?

Do you employ advanced threat detection technologies to identify potential cybersecurity threats?

Are stakeholders regularly involved in identification, assessment and management of risk?

Are business continuity plans updated based on lessons learned from actual incidents?

Are escalation procedures clearly defined and known to all relevant staff for different types of security incidents and initial evaluation of the severity?

Are recovery time objectives (RTOs) defined, communicated, and tested for critical IT systems?

Are business continuity plans tested under different scenarios to check their effectiveness in various potential incidents?

Do you regularly evaluate the effectiveness of cybersecurity training programs?

Is your security architecture periodically reviewed and updated to reflect current cybersecurity practices and threats?

Are post-incident reviews conducted to analyze the response and identify areas for improvement?

Is there a formal mechanism for incorporating feedback from audits and incidents into the risk management process?

Do you adopt and adapt emerging technologies to enhance risk management processes?

Are cybersecurity risk management processes integrated with the overall risk management framework in the organization?

Is there an effective mechanism in place for employees to report cybersecurity concerns or incidents?

Are advanced workshops or training sessions provided for the staff on specific cybersecurity threats and countermeasures?

Do you maintain redundant infrastructure or services to ensure continuity in the event of a significant cybersecurity incident?

Are employees trained on the legal aspects of cybersecurity, including the requirements for privacy, data and information protection including the NIS directive as well?

Do you conduct interdependency analyses to understand how disruptions to one system or process could affect others?

Are you implementing or planning to implement a Zero Trust security model?

Do you have a communication plan in place for coordinating with external stakeholders during a cybersecurity incident?

Is there formal agreement clauses in place that require suppliers to report security incidents?

Is there a designated cybersecurity officer or team responsible for risk management?

Do you conduct regular business impact analyses to determine critical systems and data essential for your organization’s continuity?

Do you have arrangements with external cybersecurity firms for additional support during an incident?

Do you have specific plans for managing cybersecurity incidents that involve your supply chain?

Do you have legal counsel to manage the reporting of cybersecurity incidents as per regulatory requirements?

Are minimum cybersecurity standards defined and enforced for all suppliers and third-party service providers?