In this lesson,
we're going to perform an internal assessment.
Now, the exact checklist and procedures
that you're going to use to perform an internal assessment
are going to vary depending
on your organization's own governance, risk,
and compliance practices.
But for this video, we will be using a sample checklist
from the Minnesota Counties Intergovernmental Trust,
known as the MCIT.
This governmental organization
has created a checklist to assist its members
in minimizing their exposures related
to data and cybersecurity by identifying
and addressing these potential risks and vulnerabilities.
The Cybersecurity Self-Assessment Checklist
that MCIT created is a broad checklist
that an organization can use internally to assist
in the identification of data security areas
that might need to be strengthened by the organization.
To use the Cybersecurity Self-Assessment,
you'll answer a series of yes or no questions
and provide areas for comments and action items
as well as to whom those action items are being assigned to
for completion.
Each action item should be assigned to a specific individual
or group so that someone is going to be responsible
for following up with the designees to make sure
that any correct actions are properly performed
and implemented.
To get the most out of this kind
of self-assessment checklist,
you should have people from across your organization
working on it together as a group,
including your administration team,
your information technology staff,
and your cybersecurity professionals,
to ensure the risks across the organization
are well understood.
So let's take a quick look
at this Cybersecurity Self-Assessment Checklist.
Here is the example
of the Cybersecurity Self-Assessment Checklist.
I'm going to just read through the first five items
just to give you a feel
of what the checklist entails.
Across the top, we see we have the completed by,
title of the assessment, date,
and signature of the individual
performing the self-assessment.
Across the top of the columns, we also see the item,
the yes or no
because every question is going to be a yes or no question,
the department or vendor that's responsible,
the comments, action items to be performed,
and who is this task assigned to.
Now, reading question number one, the question states,
"Has your organization,
at any time during the past 12 months,
experienced a cybersecurity incident like hacking,
intrusion, malware infection, fraud loss,
breach of personal information, extortion, et cetera,
or experienced a lawsuit or other formal dispute
with either a private party or government agency
arising from a cybersecurity incident?"
Now that's the first question.
Next, we see a sub-question to that same number one,
"Have deficiencies been identified and addressed?"
Scrolling down, we see we have number two,
"Do you have a data security incident response plan
that addresses responsibilities, incident identification,
triage, notification, investigation
threat/vulnerability removal,
recovery and business continuity?"
Question number three states,
"Is a business continuity plan established
that includes an inventory of vital operations,"
so that's one,
"inventory of IT hardware and software essential
to those operations,"
that will be the second question,
"identification of third parties, vendors,
or neighboring organizations or agreements made
to carry out those business continuity plans
as well as do we have a well-documented agreement
with clear responsibilities in place
with the noted parties?"
Going to question number four,
"Does every device in your organization
have antivirus and anti-malware software installed
and do you keep this software up to date?"
Question number five,
"Does the organization have a mobile device policy?
Has staff been trained about this policy?
Does the policy outline whether personally owned devices
are permissible for work purposes
and under what requirements?"
So as you can see,
these checklists are going to be very broad
and they're seeking to get a quick overview
of your organization's current risk posture.
As I said earlier,
your organization may use a different checklist
or ones with different questions,
but the general format
and purpose of these self-assessments remain the same
across most organizations.
So remember, cybersecurity and database exposures
are some of the largest potential loss drivers
from most organizations
and you can help prevent these exposures
by identifying and addressing the risk and vulnerabilities
within your organization
so that you are well prepared to mitigate
and remediate these risks over time.