Resilience Audit Self-Assessment

Do you operate multiple, separate systems with data duplicated across them?

Yes - we have different systems across the company with some teams working from spreadsheets.

Yes but there are routines that sync data across the systems.

Yes but we have good integration between them.

No we operate a fully integrated ERP solution.

This will help us understand more about the digital maturity of your organisation

How easy is it to measure performance within your business?

Very difficult

We create monthly / weekly reports but its very time consuming.

We get real time updates on some KPIs on the go.

We can access real time information from any device, anywhere.

This will help us understand more about the digital maturity of your organisation

Does your business software automate low-value, repetitive tasks with some digital workflow?

No, there is none.

A small amount but it does not work well

Yes but we rely on expensive 3rd party systems to update workflow.

Yes, we have good automation and workflow, we operate a digital paperless workplace.

This will help us understand more about the digital maturity of your organisation

How easy is it for your customers and suppliers to engage with you digitally?

Difficult, we are still very paper-based with orders taken over the phone or on email.

Hard, some can engage with us but it often requires manual intervention.

Not easy, some electronic data interchange (EDI) is possible but not used.

Easy, and it is fully integrated with our internal systems.

This will help us understand more about the digital maturity of your organisation

Can company mobile devices access real time company data?

No - our internal systems do not permit remote access from any device.

No, only batch updates of static data via messaging / email only.

Yes via an application but only when connected to the internet or Wi-Fi.

Yes access via app for real time data and also the ability to update when offline and sync later.

This will help us understand more about the digital maturity of your organisation

How effective was your business continuity plan when COVID-19 hit?

We didn't have a suitable plan in place which damaged our operations.

Ineffective. We could continue operating, but fundamental issues were exposed in our plan.

Quite effective, but minor issues were exposed in our plan.

Very effective, we had a plan and it was well executed.

This will help us understand more about your plans and processes for business continuity

Does your business perform any disaster recovery scenario planning to mitigate risk?

No

The recent events have sharpened our focus and something we are planning

Yes but not tested

Yes and we test periodically

This will help us understand more about your plans and processes for business continuity

Do you understand the business implications and cost of system downtime or data loss?

Not thought about it

Thought about it but hoping never to have downtime

Rough estimate in lost revenue during recovery time has been done

We review availability needs regularly and tune our recovery plans accordingly

This will help us understand more about your plans and processes for business continuity

Can employees access systems remotely across multiple devices to perform their role?

No remote access to systems

Limited access to systems - only some functions can be performed remotely. The solution hasn't been security tested

Seamless access to on-premise systems via VPN connection

Seamless access to cloud-based applications from variety of devices

This will help us understand more about your plans and processes for business continuity

Do you perform back-ups?

No

Yes - but its not a routine procedure

Yes - multiple back-ups but not tested or back-ups tested but no disconnected backups

Yes - we follow industry best practice, i.e. 3 forms of backups that are tested regularly

This will help us understand more about your plans and processes for business continuity

Do you secure data on portable devices, i.e. laptops, memory sticks etc.?

No - there is no protection in place

We have password protection on portable devices

We encrypt devices but do not keep records

Yes we encrypt all portable devices as company policy and centralised records are kept

This will help us understand more about the cyber resilience within your organisation

Do you have a standard way of testing the capabilities of your firewalls against the latest malware and vulnerabilities?

No - None

We believe our configuration is okay but it hasn't been tested

We regularly review firewall configuration and the business approves its rules

We regularly review firewall configuration and the business approves its rules. In addition we follow industry recommendations and undertake regular vulnerability assessments

This will help us understand more about the cyber resilience within your organisation

Do you have an access control policy?

No - everyone gets access to all systems

Yes - role base access but no password policy enforcement, i.e. weak passwords are permitted

Yes - role based access supported by password policy enforcement

Yes - role based access supported by password policy and two factor authentication

This will help us understand more about the cyber resilience within your organisation

Do you have a formal staff training programme around cyber security?

No training given

One-off training that is sporadic

Yes - but no management reports are provided on training progress or employee understanding

Yes - with management reports to track staff progress and identify follow up actions

This will help us understand more about the cyber resilience within your organisation

Do you have anti-virus and malware protection in place?

Don't know

Yes - but not centrally managed - there's no way of tracking whether devices are up to date

Yes - centrally managed system using basic detection

Yes - centrally managed system using behaviour-based detection. We also have systems to determine the root cause if an issue arises

This will help us understand more about the cyber resilience within your organisation

Does your IT partner undertake proactive maintenance activities and advise of issues and remediation actions ahead of time?

No

No - we have to ask them / remind them and its an extra cost

Yes - but we are not notified of potentially upcoming issues, for example coming close to exceeding the capacity of a system

Yes - they undertake regular proactive maintenance with follow-up reports identifying actions to remediate

This will help us understand more about IT management within your organisation

Do you have an IT Roadmap in place to help with system end-of-life planning and forecasted expenditure?

No

Not really, we are reactive, if it breaks we fix it

Yes but this forecast is never accurate

Yes we have a detailed projection for multiple years that is aligned with our business goals

This will help us understand more about IT management within your organisation

How much do you agree with this statement: Our IT partner is aligned to our business goals and strategy?

Strongly disagree

Disagree

Neutral

Agree

This will help us understand more about IT management within your organisation

Is your IT partner proactive in recommending cost reduction and efficiency gains?

No, its not within their remit

No, only when we identify overspend or inefficiencies

Yes, mainly during contract renewals

Yes, they conduct regular service reviews identifying opportunities to make our business more efficient

This will help us understand more about IT management within your organisation

What will be the impact if your IT partner went out of business?

Significant, we are utilising their proprietary systems that only they can support

Major, no operating procedures and config exists, but we are using Commercial off the Shelf solutions

Minimal, standard operating procedures exist but no system configuration documentation exist

No impact, there are standard operating procedures that follow industry best practice as well as system configuration documentation

This will help us understand more about IT management within your organisation

Resilience Audit Self-Assessment

Do you operate multiple, separate systems with data duplicated across them?

How easy is it to measure performance within your business?

Does your business software automate low-value, repetitive tasks with some digital workflow?

How easy is it for your customers and suppliers to engage with you digitally?

Can company mobile devices access real time company data?

How effective was your business continuity plan when COVID-19 hit?

Does your business perform any disaster recovery scenario planning to mitigate risk?

Do you understand the business implications and cost of system downtime or data loss?

Can employees access systems remotely across multiple devices to perform their role?

Do you perform back-ups?

Do you secure data on portable devices, i.e. laptops, memory sticks etc.?

Do you have a standard way of testing the capabilities of your firewalls against the latest malware and vulnerabilities?

Do you have an access control policy?

Do you have a formal staff training programme around cyber security?

Do you have anti-virus and malware protection in place?

Does your IT partner undertake proactive maintenance activities and advise of issues and remediation actions ahead of time?

Do you have an IT Roadmap in place to help with system end-of-life planning and forecasted expenditure?

How much do you agree with this statement: Our IT partner is aligned to our business goals and strategy?

Is your IT partner proactive in recommending cost reduction and efficiency gains?

What will be the impact if your IT partner went out of business?

Register