ISMG | Critical Infrastructure Research Survey

Question Title

1. Does your Organization have a documented, agency-wide cybersecurity policy? (Required.)

Yes

Implementation in Progress

Planned

Question Title

2. To what extent have you implemented the NIST Cybersecurity Framework (CSF), NIST 800-53, or a similar recognized framework (e.g., CIS Controls)? (Required.)

Fully Implemented

Partially Implemented

In the planning phase

Not Implemented

Not Applicable/Don’t know

Question Title

3. Does your organization have a formally documented incident response plan? (Required.)

Yes

Partially Implemented

In the planning phase

Don’t Know

Question Title

4. How would you rate your organization’s current ability to quickly restore critical services following a cyberattack? (Required.)

Excellent (Minimal downtime, tested procedures)

Good (We have a plan, but it not fully untested)

Fair (We have some backup systems, but no formal plan)

Poor (We are not prepared for a major recovery)

Don’t Know

Question Title

5. What are the top cybersecurity threats your organization currently faces? (Select up to 3) (Required.)

Ransomware

Phishing/social engineering

Malware/viruses

Insider threats

Supply chain/vendor compromise

IoT vulnerabilities

AI-powered attacks (e.g. deepfakes, automated phishing)

Other (please specify)

Question Title

6. Which types of systems are most vulnerable in your environment? (Required.)

Legacy IT systems

OT/SCADA systems

Cloud-based applications

Mobile devices

IoT/smart devices

Third-party platforms

Question Title

7. Does your organization regularly conduct automated scanning or penetration testing to identify external vulnerabilities? (Required.)

Yes, Frequently (More than twice a year)

Regularly (At least annually)

Yes, but only on an ad-hoc basis

Don’t know.

Question Title

8. To what extent does your organization maintain a comprehensive and up-to-date inventory of all public-facing assets (e.g., websites, servers, remote access portals)? (Required.)

Fully comprehensive

Partially comprehensive

Not comprehensive

Poor

Question Title

9. How would you describe your organization’s inventory of OT (e.g., SCADA, PLC) and IoT devices (video cameras, conference room equipment, VOIP phones, etc.)? (Required.)

Comprehensive and up-to-date inventory

Partial, with some blind spots

Poor

Non-existent

Question Title

10. Are OT and IT networks at your agency segmented from one another? (Required.)

Fully segmented

Partially segmented

Not segmented

Don’t know

Question Title

11. How frequently are firmware and software patches applied to your OT and IoT devices? (Required.)

Immediately upon release

On a scheduled basis (e.g., quarterly, bi-annually)

Only when a major vulnerability is identified

Rarely or never

Don’t know

Question Title

12. What are your top three biggest challenges in securing your OT and IoT environment? (number as 1 for biggest challenge, 2 for second, 3 for third) (Required.)

Question Title

13. How is remote access to your organization’s internal networks and applications managed? (Required.)

Through a VPN or other secure gateway

Through a Zero Trust Network Access (ZTNA) solution

Directly over the internet with username/password authentication

Remote access is not permitted

Don’t know

Question Title

14. How does your organization manage remote access for third-party vendors or contractors (e.g., equipment manufacturers, maintenance providers)? (Required.)

They use the same remote access method as internal employees.

We provide them with dedicated, separate access channels.

Their access is managed by the vendor, with minimal oversight from us.

Third-party remote access is not permitted.

Don’t know

Question Title

15. Do you use a "just-in-time" or "least privilege" approach for remote access, where permissions are granted only when needed and for a limited duration? (Required.)

Yes, this is a core principle of our remote access policy.

In some cases, but not universally across all systems.

No, users are granted standing access based on their role.

Don’t know.

Question Title

16. Which strategies have proven successful in mitigating cybersecurity concerns around critical infrastructure resilience? Tick your top three. (Required.)

Leveraging cloud-based AI solutions

Improving in-house expertise (training) to reduce external costs

Leveraging Outsourced providers/Vendor partner solutions

Implementing Zero Trust Approaches

Implementing inventory control

Conducing regular compliance audits/Improving governance

Regular pentesting/red teaming

Automating patch management

ISMG | Critical Infrastructure Research Survey

Question Title

* 1. Does your Organization have a documented, agency-wide cybersecurity policy? (Required.)

Question Title

* 2. To what extent have you implemented the NIST Cybersecurity Framework (CSF), NIST 800-53, or a similar recognized framework (e.g., CIS Controls)? (Required.)

Question Title

* 3. Does your organization have a formally documented incident response plan? (Required.)

Question Title

* 4. How would you rate your organization’s current ability to quickly restore critical services following a cyberattack? (Required.)

Question Title

* 5. What are the top cybersecurity threats your organization currently faces? (Select up to 3) (Required.)

Question Title

* 6. Which types of systems are most vulnerable in your environment? (Required.)

Question Title

* 7. Does your organization regularly conduct automated scanning or penetration testing to identify external vulnerabilities? (Required.)

Question Title

* 8. To what extent does your organization maintain a comprehensive and up-to-date inventory of all public-facing assets (e.g., websites, servers, remote access portals)? (Required.)

Question Title

* 9. How would you describe your organization’s inventory of OT (e.g., SCADA, PLC) and IoT devices (video cameras, conference room equipment, VOIP phones, etc.)? (Required.)

Question Title

* 10. Are OT and IT networks at your agency segmented from one another? (Required.)

Question Title

* 11. How frequently are firmware and software patches applied to your OT and IoT devices? (Required.)

Question Title

* 12. What are your top three biggest challenges in securing your OT and IoT environment? (number as 1 for biggest challenge, 2 for second, 3 for third) (Required.)

Question Title

* 13. How is remote access to your organization’s internal networks and applications managed? (Required.)

Question Title

* 14. How does your organization manage remote access for third-party vendors or contractors (e.g., equipment manufacturers, maintenance providers)? (Required.)

Question Title

* 15. Do you use a "just-in-time" or "least privilege" approach for remote access, where permissions are granted only when needed and for a limited duration? (Required.)

Question Title

* 16. Which strategies have proven successful in mitigating cybersecurity concerns around critical infrastructure resilience? Tick your top three. (Required.)

Question Title

* 17. What is the single most important action your organization plans to take in the next 12 months to improve your cybersecurity posture? (Open-ended)

1. Does your Organization have a documented, agency-wide cybersecurity policy? (Required.)

2. To what extent have you implemented the NIST Cybersecurity Framework (CSF), NIST 800-53, or a similar recognized framework (e.g., CIS Controls)? (Required.)

3. Does your organization have a formally documented incident response plan? (Required.)

4. How would you rate your organization’s current ability to quickly restore critical services following a cyberattack? (Required.)

5. What are the top cybersecurity threats your organization currently faces? (Select up to 3) (Required.)

6. Which types of systems are most vulnerable in your environment? (Required.)

7. Does your organization regularly conduct automated scanning or penetration testing to identify external vulnerabilities? (Required.)

8. To what extent does your organization maintain a comprehensive and up-to-date inventory of all public-facing assets (e.g., websites, servers, remote access portals)? (Required.)

9. How would you describe your organization’s inventory of OT (e.g., SCADA, PLC) and IoT devices (video cameras, conference room equipment, VOIP phones, etc.)? (Required.)

10. Are OT and IT networks at your agency segmented from one another? (Required.)

11. How frequently are firmware and software patches applied to your OT and IoT devices? (Required.)

12. What are your top three biggest challenges in securing your OT and IoT environment? (number as 1 for biggest challenge, 2 for second, 3 for third) (Required.)

13. How is remote access to your organization’s internal networks and applications managed? (Required.)

14. How does your organization manage remote access for third-party vendors or contractors (e.g., equipment manufacturers, maintenance providers)? (Required.)

15. Do you use a "just-in-time" or "least privilege" approach for remote access, where permissions are granted only when needed and for a limited duration? (Required.)

16. Which strategies have proven successful in mitigating cybersecurity concerns around critical infrastructure resilience? Tick your top three. (Required.)

17. What is the single most important action your organization plans to take in the next 12 months to improve your cybersecurity posture? (Open-ended)