Security Assessment – BINARY KAPPA

Question 1 of 20

Are all company devices (laptops, desktops, mobiles) protected by an endpoint security solution?

Yes, all devices are covered

Most devices, with some exceptions

Only some devices

No endpoint protection in place

Question 2 of 20

How frequently are security patches and updates applied to endpoints?

Automated, within 24–48 hours

Manually, within a week

Monthly or less frequently

No formal patching process

Question 3 of 20

Is there a Mobile Device Management (MDM) solution in place for company and BYOD devices?

Yes, for all devices

Yes, for company-owned devices only

Partially implemented

No MDM solution

Question 4 of 20

Are endpoints monitored for threats and suspicious activity in real time?

Yes, with automated alerts and response

Yes, with manual monitoring

Partially — some devices are monitored

No real-time monitoring

Question 5 of 20

Is Multi-Factor Authentication (MFA) enforced for all user accounts, including email and cloud services?

Yes, MFA is enforced for all users

MFA is enabled but not enforced for all

MFA is optional

No MFA in place

Question 6 of 20

Do you follow the principle of least privilege — users only access what they need for their role?

Yes, with regular access reviews

Yes, but access reviews are infrequent

Partially implemented

No formal access control policy

Question 7 of 20

How are privileged accounts (admin, IT, service accounts) managed and monitored?

Dedicated privileged access management (PAM) solution

Separate admin accounts with manual monitoring

Same accounts as standard users but with admin rights

No separation or monitoring of privileged accounts

Question 8 of 20

When an employee leaves the organisation, how quickly are their access credentials revoked?

Immediately, automated on HR offboarding

Same day, manually

Within a week

No formal offboarding process for access

Question 9 of 20

Does your organisation have a Next-Generation Firewall (NGFW) with active threat prevention?

Yes, with active threat prevention and regular updates

Yes, but not fully configured for threat prevention

Basic firewall only

No dedicated firewall

Question 10 of 20

Is your network segmented to isolate critical systems and limit lateral movement in a breach?

Yes, full segmentation with micro-segmentation

Basic segmentation (e.g. separate guest Wi-Fi)

Limited segmentation

No network segmentation

Question 11 of 20

How is remote access (VPN, RDP) secured for employees working outside the office?

VPN with MFA and access controls

VPN without MFA

Direct RDP without VPN

No formal remote access security

Question 12 of 20

Is DNS filtering and web traffic monitored to block malicious sites?

Yes, with automated DNS filtering and monitoring

Partially — some filtering in place

Minimal filtering

No DNS filtering or web monitoring

Question 13 of 20

Is sensitive company and customer data identified, classified, and protected with appropriate controls?

Yes, with a formal data classification policy

Partially identified and classified

Limited awareness of where sensitive data resides

No data classification in place

Question 14 of 20

How are your critical systems and data backed up?

Automated daily backups, offsite/cloud, tested regularly

Automated backups but rarely tested

Manual or infrequent backups

No formal backup strategy

Question 15 of 20

Do you have Data Loss Prevention (DLP) controls to prevent sensitive data leaving the organisation?

Yes, DLP tools actively enforced

DLP policies exist but not fully enforced

Limited controls (e.g. email restrictions only)

No DLP controls

Question 16 of 20

Has your backup and disaster recovery been tested with a simulated restore in the past 12 months?

Yes, tested and documented results

Tested but not formally documented

Last tested more than 12 months ago

Never tested

Question 17 of 20

Does your organisation have a SIEM solution to detect and respond to threats in real time?

Yes, actively monitored SIEM (e.g. Microsoft Sentinel)

SIEM in place but not actively monitored

Partial log collection without centralised SIEM

No SIEM or centralised log monitoring

Question 18 of 20

Do you have a documented Incident Response (IR) plan that is tested regularly?

Yes, documented and tested in the past year

Documented but not tested

Informal plan, not documented

No incident response plan

Question 19 of 20

Are employees trained on cybersecurity awareness (phishing, social engineering, password hygiene)?

Yes, regular training and simulated phishing tests

Annual training only

Ad hoc awareness, no formal training

No security awareness training

Question 20 of 20

Has your organisation conducted a formal security assessment or penetration test in the past 12 months?

Yes, by a certified third party

Internal assessment only

More than 12 months ago

Never conducted a security assessment

How secure is your business right now?