Do you adopt and adapt emerging technologies to enhance risk management processes?

Do you maintain redundant infrastructure or services to ensure continuity in the event of a significant cybersecurity incident?

Are all cybersecurity policies, procedures, and compliance measures well-documented and accessible?

Do you employ advanced threat detection technologies to identify potential cybersecurity threats?

Do you have legal counsel to manage the reporting of cybersecurity incidents as per regulatory requirements?

Are relevant staff encouraged or required to obtain cybersecurity certifications?

Are you implementing or planning to implement a Zero Trust security model?

Are employees trained on the legal aspects of cybersecurity, including the requirements for privacy, data and information protection including the NIS directive as well?

Do you have specific plans for managing cybersecurity incidents that involve your supply chain?

Are business continuity plans updated based on lessons learned from actual incidents?

Is there a dedicated incident response team with clearly defined roles and responsibilities?

Do you continuously monitor and review the security practices of your suppliers and third-party service providers?

Are advanced workshops or training sessions provided for the staff on specific cybersecurity threats and countermeasures?

Is supply chain risk management integrated into the overall organizational risk management framework?

Is there formal agreement clauses in place that require suppliers to report security incidents?

Are regular, detailed cybersecurity incident simulations conducted to test readiness?

Is your security architecture periodically reviewed and updated to reflect current cybersecurity practices and threats?

Are cybersecurity training programmes tailored to employees' specific roles and responsibilities?

Do you regularly evaluate the effectiveness of cybersecurity training programs?

Are minimum cybersecurity standards defined and enforced for all suppliers and third-party service providers?

Do you have audit rights included in agreements with key suppliers to ensure compliance with your security requirements?

Is there an effective mechanism in place for employees to report cybersecurity concerns or incidents?

Is there a designated cybersecurity officer or team responsible for risk management?

Are regular security assessments conducted by internal or external parties to identify vulnerabilities and/or do penetration testing?

Do you have a communication plan in place for coordinating with external stakeholders during a cybersecurity incident?

Do you have arrangements with external cybersecurity firms for additional support during an incident?

Is there a process in place for continual improvement of risk management strategies based on new threats and vulnerabilities?

Are systems and software regularly updated to address security vulnerabilities?

Do you use user behavior analytics to detect potentially malicious activity?

Do you conduct regular business impact analyses to determine critical systems and data essential for your organization’s continuity?

Is a Data Protection Officer (DPO) appointed to ensure compliance with data protection laws and regulations?

Are recovery time objectives (RTOs) defined, communicated, and tested for critical IT systems?

Is there a dedicated function or team monitoring changes in cybersecurity regulations and ensuring compliance?

Are business continuity plans tested under different scenarios to check their effectiveness in various potential incidents?

Do you conduct interdependency analyses to understand how disruptions to one system or process could affect others?

Is there a formal mechanism for incorporating feedback from audits and incidents into the risk management process?

Are post-incident reviews conducted to analyze the response and identify areas for improvement?

Are stakeholders regularly involved in identification, assessment and management of risk?

Are escalation procedures clearly defined and known to all relevant staff for different types of security incidents and initial evaluation of the severity?

Are cybersecurity risk management processes integrated with the overall risk management framework in the organization?

Do you regularly test employees with simulated phishing attacks to enhance their vigilance?