English
Citadelis full colour logoCitadelis full logo white
Talk to an Expert

ASSESS YOUR SECURITY READINESS

Cyber Resilience Checklist

This Cyber Resilience Checklist is designed as a self-assessment tool to help you understand where your organization is in its cybersecurity and resilience journey. We do not collect, store or track your responses. Your answers remain private and are used only to help you identify potential strengths, gaps and areas to consider as you build greater cyber resilience.

Answer 30 practical questions across risk, people, technology, incident response, recovery and governance to identify where your organization is strong and where there may be gaps.

Risk & Critical Systems

1. Do we know which systems and business processes are most critical to our operations?
2. Do we know where our most sensitive or regulated data is stored?
3. Have we identified the cybersecurity risks that could have the greatest impact on the business?

People & Security Awareness

4. Do employees know how and where to report suspicious activity?
5. Do employees understand what information can and cannot be shared with AI tools?
6. Do managers and leaders understand their cybersecurity responsibilities?

Access & Identity

7. Do we know who has access to sensitive systems and information?
8. Are privileged and administrative accounts reviewed regularly?
9. Do we use multi-factor authentication for critical systems and accounts?

Technology & Monitoring

10. Are critical systems monitored for suspicious activity?
11. Are vulnerabilities and outdated systems identified and addressed regularly?
12. Do we know which devices, applications and unapproved tools are being used across the organization?

Incident Response

13. Do we have a documented incident response plan?
14. Does the plan clearly define who makes decisions during a cyber incident?
15. Have we tested our incident response plan through a tabletop exercise or similar scenario?

Recovery & Continuity

16. Have our backups been tested to confirm they can actually be restored?
17. Do we know how long critical systems can be unavailable before the business is seriously affected?
18. Do we have a plan for keeping critical operations moving if a major system becomes unavailable?

Governance & Third-Party Risk

19. Is cybersecurity risk regularly reviewed by leadership?
20. Do we have a defined process for evaluating vendors that can access our systems or sensitive data?
21. Are cybersecurity policies, responsibilities and priorities reviewed as the organization changes?