Is there a dedicated incident response team with clearly defined roles and responsibilities?

Are business continuity plans tested under different scenarios to check their effectiveness in various potential incidents?

Are employees trained on the legal aspects of cybersecurity, including the requirements for privacy, data and information protection including the NIS directive as well?

Do you have a communication plan in place for coordinating with external stakeholders during a cybersecurity incident?

Are business continuity plans updated based on lessons learned from actual incidents?

Are regular, detailed cybersecurity incident simulations conducted to test readiness?

Are escalation procedures clearly defined and known to all relevant staff for different types of security incidents and initial evaluation of the severity?

Do you adopt and adapt emerging technologies to enhance risk management processes?

Are cybersecurity risk management processes integrated with the overall risk management framework in the organization?

Do you have arrangements with external cybersecurity firms for additional support during an incident?

Are cybersecurity training programmes tailored to employees' specific roles and responsibilities?

Are regular security assessments conducted by internal or external parties to identify vulnerabilities and/or do penetration testing?

Are post-incident reviews conducted to analyze the response and identify areas for improvement?

Do you continuously monitor and review the security practices of your suppliers and third-party service providers?

Is supply chain risk management integrated into the overall organizational risk management framework?

Is there a designated cybersecurity officer or team responsible for risk management?

Do you have specific plans for managing cybersecurity incidents that involve your supply chain?

Are all cybersecurity policies, procedures, and compliance measures well-documented and accessible?

Do you regularly test employees with simulated phishing attacks to enhance their vigilance?

Do you have audit rights included in agreements with key suppliers to ensure compliance with your security requirements?

Do you use user behavior analytics to detect potentially malicious activity?

Is there a formal mechanism for incorporating feedback from audits and incidents into the risk management process?

Is there a dedicated function or team monitoring changes in cybersecurity regulations and ensuring compliance?

Is your security architecture periodically reviewed and updated to reflect current cybersecurity practices and threats?

Do you have legal counsel to manage the reporting of cybersecurity incidents as per regulatory requirements?

Is there formal agreement clauses in place that require suppliers to report security incidents?

Do you conduct interdependency analyses to understand how disruptions to one system or process could affect others?

Do you maintain redundant infrastructure or services to ensure continuity in the event of a significant cybersecurity incident?

Is a Data Protection Officer (DPO) appointed to ensure compliance with data protection laws and regulations?

Are advanced workshops or training sessions provided for the staff on specific cybersecurity threats and countermeasures?

Are relevant staff encouraged or required to obtain cybersecurity certifications?

Are minimum cybersecurity standards defined and enforced for all suppliers and third-party service providers?

Are stakeholders regularly involved in identification, assessment and management of risk?

Is there an effective mechanism in place for employees to report cybersecurity concerns or incidents?

Are recovery time objectives (RTOs) defined, communicated, and tested for critical IT systems?

Is there a process in place for continual improvement of risk management strategies based on new threats and vulnerabilities?

Do you regularly evaluate the effectiveness of cybersecurity training programs?

Do you employ advanced threat detection technologies to identify potential cybersecurity threats?

Are you implementing or planning to implement a Zero Trust security model?

Are systems and software regularly updated to address security vulnerabilities?

Do you conduct regular business impact analyses to determine critical systems and data essential for your organization’s continuity?