Information Security Assessment

Question Title

* To be completed by the person most knowledgeable about the information technology practices at your organization. RESULTS WILL NOT BE SHARED OUTSIDE OF ACS TECHNOLOGIES GROUP, INC.

Name *

Organization *

Address

Address 2

City/Town

State/Province

ZIP/Postal Code

Country

Email Address *

Phone Number

Question Title

* Do you maintain an inventory of all hardware devices connected to your network? (laptops, servers, network switches, routers, wireless access points, IOT devices, etc.)

Yes

Not Sure

Question Title

* Approximately how many hardware devices are connected to your network? (laptops, servers, network switches, routers, wireless access points, IOT devices, etc.)

0-10

11-30

31+

Question Title

* Does your organization require users to have a unique login for each account?

Yes

Not Sure

Question Title

* Does your organization require passwords to be at least 16 characters in length?

Yes

Not Sure

Question Title

* Are all devices with access to the organization's systems configured with antivirus and firewall protections?

Yes

Not Sure

Question Title

* Does your organization ensure only authorized devices are given access to your networks (including wireless)?

Yes

Not Sure

Question Title

* Does your organization use a rigorous configuration and change control process to manage the security of laptops, servers, and workstations?

Yes

Not Sure

Question Title

* Does your organization’s website protect all sensitive information transmissions with HTTPS encryption?

Yes

Not Sure

Question Title

* Does your organization have information security policies and procedures in place?

Yes

Not Sure

Question Title

* Are your information security policies and procedures reviewed and updated yearly?

Yes

Not Sure

Question Title

* Has your organization ever been a victim of cybercrime (e.g. ransomware, network breaches, malware, and/or social engineering scams)?

Yes

Not Sure

Question Title

* If your organization has been a victim of cybercrime please indicate all of the following actions taken after the event:

Initiated an Incident Response Plan

Installed additional security software or hardware controls

Initiated security awareness and education training for staff

Contacted your Internet Service Provider for additional security options

Informed your congregation/parishioners of the event

Contacted law enforcement

Filed a cyber insurance claim with your insurance provider

Contacted outside legal counsel

Question Title

* Does your organization actively manage all software on the network (including wireless networks) to ensure only authorized software can be installed?

Yes

Not Sure

Question Title

* Does your organization require the use of multifactor authentication for all remote login access to email, VPN, and cloud services?

Yes

Not Sure

Question Title

* Do you patch your operating systems and applications at least quarterly to ensure they are up to date?

Yes

Not Sure

Question Title

* Do you have procedures in place for emergency patching? (Zero-day exploits are already in progress and often require more urgent updating.)

Yes

Not Sure

Question Title

* Are all laptop and mobile devices with access to the organization's systems encrypted OR password protected?

Yes

Not Sure

Question Title

* Do administrators have two separate logins; one for administrative and another for non-administrative functions?

Yes

Note Sure

Question Title

* Does your organization have dedicated IT personnel?

Yes

Not Sure

Question Title

* Does your organization have an incident response plan (“IRP”) and team in place?

Yes

Not Sure

Question Title

* Does your organization require yearly information security training for staff/volunteers with access to systems or data (e.g. how to handle sensitive data, prevent phishing and other social engineering attacks)?

Yes

Not Sure

Question Title

* Does your organization back up critical information?

Yes

Not Sure

Question Title

* Do you conduct background checks on all staff / volunteers at least every 2 years?

Yes

Not Sure

Question Title

* Do you have security cameras monitoring your organization's premises?

Yes

Not Sure

Question Title

* Has your organization ever had an independent third-party conduct vulnerability and/or network penetration scanning?

Yes

Not Sure

Question Title

* Please share any comments or recommendations you have concerning this survey.

Disclaimer: This survey seeks to provide you with a better understanding of your organization’s information security posture. This survey touches on industry best practices, but is only a partial information security assessment.