Internal Safety Audit Questionnaire

1. Governance and risks

Security policy approved, dated, notified - present the date of approval and proof of notification.
Has designated person managing cybersecurity - Its responsibilities and responsibilities are laid down in writing and there is a certain substitute.
Management has approved and is responsible for risk management measures - Confirmation dated. The leadership can explain what was confirmed.
Management trained to recognise and evaluate cyber risks - Separate from staff training - responsibility is different.
Risk register renewed over the last 12 months - With owner, level of risk and action for each record.
Assets inventory current and with owners
List of authorised software, unauthorized removed - Not only is that set up, but what you should be.
Classification of data and retention periods - What is sensitive, how long is stored when deleted.
Register of processing operations maintained - What personal data, for the purpose to which they were transferred.

2. Staff

Prior to recruitment due diligence - The amount shall correspond to the level of access to the post.
Confidentiality and security obligations in contracts - In force after termination of employment.
Security duties described in the job descriptions
Security training for all staff - Over the past 12 months. The list of members shall be reported.
Departure process: access withdrawn, actively returned - That same day. Shows the last deceased as an example.
Disciplinary proceedings in the event of infringements known

3. Physical security and premises

Facilities physically separate from common areas - Server room is not a hallway, kitchen or open office.
Access to premises controlled and registered - Visitors accompanied and registered, list transparent.
Right of access to premises reviewed and withdrawn in due time
Power, cooling and fire protection provided in equipment room - Spare power tested, not only installed.
Space monitored and intrusion visible - Alarm or video surveillance with stored records.
Data centre or hosting service security assessed - in the case of equipment belonging to a service provider, a statement thereof.
Reliable and certified media - Discs, backup carriers, paper.
Clean table and clean screen practice followed

4. Access and identity

Review of user rights - ≥ every 6 months. This column shall not be reported in case of securitisation of liabilities.
Password policy followed - ≥12 symbols, MFA administrators, Argon2 hash.
Reserved accounts separated from daily accounts - The activities of the administrator shall be traceable to the person.
Remote access protected by multifactor authentication
Shared and service accounts inventory and reasonable

5. Supply chain

Software Component List (SBOM) generated and current - Machine-readable format. Updated at every release, not once a year.
Dependence required by version and check-sum - Without it, the construction cannot be repeated.
Dependence vulnerability scans automatically - Scanning on the way to construction. Shows the treatment of the last finds.
Pictures of containers scanned and from a known source - The base image is pinned and restored to each construction.
List of critical suppliers with a risk classification - who has access to data or the production environment.
Safeguard and notification clauses in supplier contracts - Time limit for incident notification, audit rights, data processing.
An exit plan for each critical supplier - Data recovery and withdrawal of access.

6. Development and changes

Changes to approved, traceable and return routes
Design, test and production environments separated - The production data in the test medium are not used unprocessed.
Code changes reviewed before entry into production
Security requirements included in the procurement of new solutions
Encryption keys stored safely, with replacement order - No key in the repository. Change tested, not only described.

7. Operation and sustainability

8. Configuration and malware protection

Safe configuration baseline defined and tested - Servers, workstations and services. The derogations are justified.
Default passwords replaced, unnecessary services disabled - Every open port and on service must be justified.
Evil protection on, renewed and alarm reviewed - Security not protected, but unread.
Email sender authentication introduced and monitored - SPF, DKIM and DMARC. Reports are read, not only on.
Filtering attachments and links enabled - Email is still the most frequent initial access route.
Browser and workstations hardening introduced

9. Incidents, reporting and effectiveness of controls