Md Sabbir Hossain

Readiness checks / NIST CSF 2.0

Where do you stand against NIST CSF 2.0?

Eight questions, about two minutes. Answer honestly: "Partly" counts for half.

01Is cybersecurity risk part of enterprise risk management, with a risk appetite leadership agreed?
02Are cybersecurity roles, responsibilities and authority assigned, resourced and owned by leadership?
03Do you manage cybersecurity risk in your suppliers and service providers?
04Do you keep an up-to-date inventory of hardware, software, data and services?
05Is multi-factor authentication enforced for email, remote access and admin accounts?
06Are systems patched and securely configured, with backups protected and regularly restored in tests?
07Are networks, endpoints and key services monitored so attacks are spotted quickly?
08Do you have response and recovery plans that were exercised in the last 12 months?

Other readiness checks

A quick indication, not an audit or certification opinion. Completed checks are counted anonymously (the check, your answers and your country); nothing that identifies you is stored unless you choose to contact me.