Cyber Risk Quantifier

Do all your client's employees receive cyber security awareness training relating to Email Phishing and other types of attacks such as Business Email Compromise?

Does your client have a disaster recovery plan that you test at least annually?

Can you confirm your client does not have any End of Life (EOL) or unsupported Applications or Operating Systems within their network?

Within your client's environment, has access to all servers, firewalls, and IT infrastructure components been restricted to appropriate personnel only?

Does your client have logging enabled on all Firewalls and Servers?

Does your client use Office 365, Gmail or another Hosted Service for email where access is via Browser?

If your client uses Office 365, Gmail or another Hosted Service for email where access is via Browser, do you require MFA at logon for ALL users?

Within your client's environment, are external emails tagged to alert your organization's employees that the email originated from outside the organization?

Within your client's environment, is Multi-Factor Authentication (MFA) implemented for ALL users of Cloud Service Providers such as AWS, Azure, GPC, EMR/HER, ERP, Financial or other cloud platforms that contain PII or NPI?

Within your client's environment, do all systems have individual, non-shared complex passwords with respect to length and composition?

Within your client's environment, is Microsoft Windows Local Administrator Password Solution (Windows LAPS) or a Privileged Access Management (PAM) application deployed across your Microsoft network environment?

If the client's network runs within Microsoft Azure, are all your devices Entra Joined, and if so, do you have Microsoft PIM, Intune or PAW implemented?

If the client's environment runs within Microsoft Azure, are conditional access policies implemented?

Do you have a formalized patch management program that ensures all Servers and Endpoints are updated with critical security patches within 48 hours of release?

Is your client operating with either a cloud-based WAF or traditional Firewall/IPS Appliance?

Does your client use an Advanced Endpoint Detection and Response (EDR) Application (or Anti-Virus) on all Servers and Workstations?

Within your client's environment, is there a process to verify the EDR and or AV updates were successfully installed on all devices?

Within your client's environment, is there a process in place that regularly verifies all applicable devices have EDR and AV installed on them?

Does your client use credentials unique to backups and are they stored separately from all other user credentials?

Does your client perform backups at least weekly which are stored separate from your network backup platform on a cloud hosted service or on another air-gapped platform?

Within the last year, has your client successfully restored data from backups?

Does your client allow SSL VPN, RDP or other remote access applications such as TeamViewer to their network?

If your client allows SSL VPN, RDP or other remote access applications, do they require MFA for ALL users to access network resources?