Security Reality Snapshot

Part 1 of 3

Your provider and who responds

Start with what your provider covers and who acts when you need help.

1. 1. Are your provider’s security responsibilities and exclusions written down?

   What to look for: Compare the service agreement with a responsibility list. Ask who handles alerts, changes, and incidents, and what is excluded.

   Yes, with a recordYes, but no record availablePartlyNoNot sure
2. 2. Do you know who responds to a security alert outside business hours?

   What to look for: Ask for the agreed coverage hours, escalation contacts, and who can authorize a response. Receiving an alert and responding to it are different responsibilities.

   Yes, with a recordYes, but no record availablePartlyNoNot sure

Part 2 of 3

Access and payments

Check the safeguards around administrator accounts and payment changes.

3. 3. Can your provider show which administrator accounts require multi-factor authentication?

   What to look for: Ask for a current coverage record and the exception list, including provider and remote-access accounts. Having MFA available does not establish that it is enforced.

   Yes, with a recordYes, but no record availablePartlyNoNot sure
4. 4. Are changed payment instructions checked using a contact method you already trust?

   Choose not applicable if your organization does not make payments.

   What to look for: Ask how payment changes are verified using contact details already known to be genuine, and for a record of that check.

   Yes, with a recordYes, but no record availablePartlyNoNot sureNot applicable

Part 3 of 3

Recovery and new tools

Check whether you can recover and whether new tools have clear boundaries.

5. 5. Is there a record of restoring a business-critical system and checking that it works?

   What to look for: Ask what was restored, when, how long it took, and who checked the result. A completed backup job does not establish that recovery was tested.

   Yes, with a recordYes, but no record availablePartlyNoNot sure
6. 6. If staff use AI tools, is it clear what data they may use and what they may do?

   Choose not applicable if no AI tools are used. Choose not sure if you do not know whether staff use them.

   What to look for: Ask which tools are approved, what information they may use, and which actions require human approval.

   Yes, with a recordYes, but no record availablePartlyNoNot sureNot applicable

Your next step

Your questions to take forward.

How to use your answers

Yes, with a record

You report a practice with supporting records. Check that the records are current and cover the systems you rely on. We have not reviewed them.

Yes, but no record available

Ask the responsible person for the evidence described above. A missing record is a question to resolve.

Partly or no

Clarify what is missing, who owns it, and what action is needed. Agree how completion will be checked.

Not sure

Find the person who can answer. If most answers are unknown, this checklist cannot establish your position.

Not applicable

Leave the item out of your action list and note why it does not apply. Revisit it if the business changes.

1. Start with an explicit gap involving payments, administrator access, or recovery. If you have not identified one, start with an unclear responsibility or missing record.
2. Choose up to three actions. For each, name an owner, the record or change needed, and a date to check back.
3. Agree when you need an answer and when to check back. If records and responsibilities are clear, agree when to review them again.

This is a starting order for a conversation, not a risk score or an independent assessment.