Full name*

Email address*

Definitions

IT = hardware, software and supporting infrastructure to manage and deliver information using voice, data and video. Examples: desktop computers, laptops, servers, routers, switches, etc.

OT = hardware and software that detects or causes a (physical) change through the direct monitoring and/or control of Industrial equipment, assets, processes and events. OT is also known as Industrial Control Systems (ICS) or “IT in the non-carpented areas”. Examples: Programmable Logic Controllers (PLCs), SCADA systems, Builiding Management Systems, HVAC systems, etc.

IoT = Internet of Things; devices with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the internet or other communications. Examples: temperature sensors, security cameras, motion detection sensors, electronic locks, access control devices, wearables, etc.

MFA = Multi-Factor Authentication (MFA) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism.

1. Risk Analysis

1.1: Does your organization perform a risk analysis, which is guided and supported by management that sets the foundation for the cybersecurity program?

1.2: Does this risk analysis include all domains (IT, OT, IoT, Physical) within your organization?

1.3: How often is a risk analysis performed within your organization?

1.4: Is the Board/Management of your organization constantly informed about and proactively involved in the Risk Analysis program?

1.5: Which domains within your organization are covered by the Risk Analysis?

There’s no risk analysis	Only the IT domain is covered	The IT and OT domains are covered	The IT, OT and IoT domains are covered	The complete environment of the organization is covered (IT, OT, IoT and Physical domain)

2. Information Security Policies

2.1: Does your organization have Information Security Policies that are automatically enforced by the IT Security/CISO team?

2.2: How often are these Information Security Policies reviewed to ensure their continuing suitability, adequacy and effectiveness?

2.3: Are the Information Security Policies pro-actively promoted and supported by your Board/Management?

2.4: Do the information security policies within your organization apply to all domains (IT, OT and IoT)?

2.5: Are these Information Security Policies communicated to all employees and external parties?

3. Incident Handling

3.1: Does your organization have an internal process for reporting incidents in the IT, OT and IoT domains, which is supported by the Board/Management ?

3.2: How often is this incident response process reviewed?

3.3: How often is this incident response process tested in practice within your organization?

3.4: Does your organization have an up-to-date phone number list in case of a cyber incident, which is also regularly reviewed?

3.5: Does your organization have a process in place to collect all evidence of the incident and develop lessons learned, which are shared with management and employees?

4. Business Continuity

4.1: Does your organization have a standard process in place that can identify interruptions to business processes, and determine the probability & impact of these interruptions and their consequences?

4.2: Does your organization have developed and implemented plans to maintain and restore operations at the required level following interruption to, or failure of critical business processes?

4.3: How often will the business continuity plans be tested within your organization?

4.4: Does your organization have a Business Continuity Planning Framework, which will be audited at least once a year by an external auditor?

4.5: Are the business continuity plans within your organization applicable to all IT, OT, IoT and external supplying systems?

5. Supply Chain Security

5.1: Does your organization have security controls, service definitions and delivery levels documented in third-party service level agreements (SLAs), that will be regularly monitored, reviewed and audited?

5.2: Does your organization have a dedicated/specialized supply chain security person/team for IT with support and mandate from the Board/Management?

5.3: Does your organization have a dedicated/specialized supply chain security person/team for OT with support and mandate from the Board/Management?

5.4: Does your organization have a dedicated/specialized supply chain security person or team for IoT with the support of and mandate from the Board/Management?

5.5: Does your organization demand certain cybersecurity requirements from its IT, OT and IoT suppliers, which are also inspected on a regular basis?

6. System Acquisition, Development & Maintenance

6.1: Do the statements for new IT, OT and IoT systems, or enhancements to existing IT, OT and IoT systems specify requirements for security controls?

6.2: Are the data inputs to all IT, OT and IoT applications validated to ensure that this data is correct and appropriate?

6.3: Are there procedures in place to control the installation of software on OT systems?

6.4: Is the outsourced software development supervised, monitored and tested by your organization?

6.5: Are the detected technical vulnerabilities collected, documented, analyzed and evaluated to address the associated risk within your organization?

7. Vulnerability Handling

7.1: Are the detected vulnerabilities on IT, OT and IoT systems reported through appropriate management channels as quickly as possible?

7.2: Are all employees, contractors and third-party users required to note and report any observed or suspected security weaknesses in IT, OT and IoT systems?

7.3: Does your organization have established responsibilities and procedures to ensure a quick, effective and orderly response to detected vulnerabilities within IT, OT and IoT systems?

7.4: Are the vulnerability handling and disclosure procedures within your organization being tested, analyzed and adjusted regularly?

7.5: Are there mechanisms and procedures in place within your organization to learn from the vulnerability handling and disclosure cases on IT, OT and IoT systems?

8. Cybersecurity Risk Management Effectiveness Measures

8.1: Does your organization have policies and procedures in place to assess the effectiveness of cybersecurity risk management measures for IT systems?

8.2: Does your organization have policies and procedures in place to assess the effectiveness of cybersecurity risk management measures for OT systems?

8.3: Does your organization have policies and procedures in place to assess the effectiveness of cybersecurity risk management measures for IoT systems?

8.4: Does your organization have a dedicated person or team to analyze, document and manage the risk management effectiveness measures within IT?

8.5: Does your organization have a dedicated person or team to analyze, document and manage the risk management effectiveness measures within OT and IoT?

9. Basic Cyber Hygiene

9.1: Does your organization require strong passwords for all employees, contractors and third-party users, which requires password changes on a regular basis for all your IT, OT and IoT applications?

9.2) Are software patches/updates for all IT, OT and IoT devices applied within your organization as soon as they come available?

9.3: Are all firewalls properly configured and is the antivirus and antimalware software up-to-date within your organization?

9.4: Are the different IT, OT and IoT networks within your organization segmented and is access to these segmented networks enforced with Multi-Factor Authentication (MFA)?

9.5: Does your organization back up all mission-critical data?

10. Cyber Security Training

10.1: Does your organization perform mandatory IT cybersecurity (awareness) training for all employees, contractors, third-party users and the Board/Management?

10.2: Does your organization perform mandatory OT cybersecurity training for all employees, contractors, third-party users and the Board/Management?

10.3: Does your organization perform mandatory IoT cybersecurity training for all employees, contractors, third-party users and the Board/Management?

10.4: Does your organization perform a mandatory customized cybersecurity training for all developers?

10.5: Does your organization perform reviews, audits and lessons learned on these cybersecurity security trainings?

11. Cryptography & Encryption

11.1: Does your organization have developed and implemented a policy on the use of cryptographic controls for the protection of information within IT systems?

11.2: Does your organization have developed and implemented a policy on the use of cryptographic controls for the protection of information within OT systems?

11.3: Does your organization have developed and implemented a policy on the use of cryptographic controls for the protection of information within IoT systems?

11.4: Is key management in place within your organization to support the organization’s use of cryptographic and encryption techniques?

11.5: Does your organization ensure that all cryptographic controls are used in compliance with relevant agreements, laws and regulations?

12. Human Resource Security

12.1: Does your organization have a Human Resource Security policy that defines and documents all security roles and responsibilities for employees, contractors and third-party users?

12.2: Does your organization perform background verification checks on all candidates for employment, contractors and third-party users in accordance with relevant laws, regulations and ethics, and proportional to the business requirements and perceived risks?

12.3) Does your organization provide mandatory cybersecurity awareness, education and training to all employees and, where relevant contractors and third-party users?

12.4: Does your organization clearly define and document the responsibilities and procedures when an employee terminates or changes his/her employment status?

12.5: Does your organization have a standard procedure in place that removes all access rights of employees, contractors and third-party users to all organizational data and physical facilities upon termination of their employment, contract or agreement?

13. Access Control Policies

13.1: Does your organization have a documented Access Control Policy for access to IT, OT and IoT assets, that will be regularly reviewed and updated based on business and security requirements?

13.2: Does your organization have secure areas protected by appropriate security perimeter controls to limit physical access to authorized personnel only?

13.3: Is there a formal user registration and de-registration procedure in place for granting and revoking access to all IT, OT and IoT assets within your organization?

13.4: Does your organization have a secure log-on procedure with a unique identifier (user ID) and suitable authentication technique for accessing operating systems?

13.5: Does your organization have automated controls in place for shutting down inactive sessions on the network after a defined period of inactivity and/or a defined limitation of connection times?

14. Asset Management

14.1: Does your organization have a complete and automatically updated asset inventory of all IT assets?

14.2: Does your organization have a complete and automatically updated asset inventory of all OT assets?

14.3: Does your organization have a complete and automatically updated asset inventory of all IoT assets?

14.4: Is the ownership, usage, change and vulnerability management of all IT, OT and IoT assets within the organization properly documented and managed?

14.5: Does your organization have a complete overview and insights of all IT, OT and IoT assets that will be accessed and maintained by external third-party companies?

15. MFA/Authentication solutions

15.1: Does your organization have an MFA/Authentication policy for IT systems that is supported by the Board/Management?

15.2: Does your organization have an MFA/Authentication policy for OT systems that is supported by the Board/Management?

15.3: Does your organization have an MFA/Authentication policy for IoT systems that is supported by the Board/Management?

15.4: Does your organization enforce the MFA/Authentication procedures for IT, OT and IoT systems?

15.5: Does your organization review and audit the MFA/Authentication procedures for IT, OT and IoT regularly?

Cyber Resilience Assessment Tool (CRAT)