0%
0 of 355 answered
Scope statement
0/1
Cyber Essentials
0/4
A1 Governance
0/5
A2 Risk management
0/13
A3 Asset management
0/4
A4 Supply chain
0/8
A5 Physical security
0/9
B1 Resilience policy
0/3
B2 Identity and access
0/38
B3 Data security
0/68
B4 System security
0/80
B5 Resilient networks and systems
0/28
B6 Staff awareness
0/13
B7 Personnel and environment
0/12
C1 Security monitoring
0/38
C2 Proactive detection
0/8
D1 Incident response
0/16
D2 Recovery and improvement
0/7

🪖 DCC Readiness Assessment

Target level:
Auto-saved to your browser
Scope statement 0/1 ▼
0000.1 · Levels 0–3
Have you written and signed a DCC scope statement, backed by diagrams and system lists that show exactly what is in and out of scope, and does it cover everything the certification needs to?
The scope decides what every other answer refers to, so it is checked first. The assessor needs to understand your scope from your documents alone: organisation and network diagrams, a list of systems, and which of them your Cyber Essentials certificate covers. A scope that is unclear, or leaves out things it should include, fails the whole assessment.
Cyber Essentials 0/4 ▼
0001.1 · MOD 000011 · Levels 0–3
Is your Cyber Essentials certification in place and does its scope take in every internet-connected device and network inside your DCC scope?
Cyber Essentials only covers equipment connected to the internet, so your DCC scope, which also includes offline systems, will usually be wider. The assessor checks that the two scopes line up, allowing for devices Cyber Essentials itself leaves out, and a mismatch fails the whole assessment. Expect to provide your certificate number, your Cyber Essentials questionnaire or report, and a diagram showing where the Cyber Essentials scope sits within the DCC scope.
0001.2 · MOD 000625 · Levels 0–3
Will you keep your Cyber Essentials certification renewed for as long as your DCC certification, and any related contract, lasts?
Cyber Essentials certificates expire, so this checks you have committed to renewing on time and to following scheme updates for the life of your DCC certification and any contracts it supports. A signed commitment or a record of past renewals is the usual evidence.
0002.1 · MOD 000012 · Levels 2–3
Is your Cyber Essentials Plus certification in place and does it cover the scope this work requires?
Cyber Essentials Plus adds a hands-on technical audit to the Cyber Essentials questionnaire. The assessor will want your certificate number and the Cyber Essentials Plus audit report or questionnaire, and will check the scope matches what the contract needs.
0002.2 · MOD 000365 · Levels 2–3
Will you keep your Cyber Essentials Plus certification renewed for the full length of any contract linked to this work?
This checks you intend to keep Cyber Essentials Plus in force without gaps while the contract runs. Provide a signed commitment or show a history of renewing on time.
A1 Governance 0/5 ▼
1100.1 · MOD 000366 · Levels 1–3
Do you have written management policies and processes covering the security of your networks and information systems?
Security needs to be run in a consistent, planned way rather than case by case. The assessor will ask to see the policy and process documents themselves.
1100.2 · MOD 000013 · Levels 1–3
Which of these apply to your management policies and processes?
  • Signed off by management
  • Shared with all staff, contractors included
  • Each has an owner who maintains and reviews it
  • Reviewed at least annually
A policy only works if leadership backs it, people know about it and someone keeps it current. Version histories or change logs usually show approval, ownership and review dates, and a staff email or message announcing a policy shows it was communicated.
1101.1 · MOD 000368 · Levels 2–3
Is there a person or team who leads security management at board level, or the equivalent in your organisation?
This checks that security has a leader at the top of the organisation rather than sitting only with IT. Be ready to name the person or team and give their contact details.
1102.1 · MOD 000017 · Levels 1–3
Have you set out who is responsible for network and information system security at each level, with clear routes for communicating and escalating risks?
Everyone involved should know their security duties and how to raise a concern so it reaches the right person. Useful evidence includes an organisation chart for security, job descriptions listing security duties, and records of a risk or incident being escalated.
1103.1 · MOD 000018 · Levels 2–3
Does a senior leader hold accountability for the security of your networks and information systems, and can they delegate decisions to the right people?
This checks that someone senior owns security and can delegate decisions to those best placed to make them. Show the role and its responsibilities, and records such as meeting minutes where that person made or delegated security decisions.
A2 Risk management 0/13 ▼
1200.1 · MOD 000369 · Levels 1–3
How often do you actively manage cyber security risks across the whole organisation?
Cyber risks change quickly, so they need regular attention rather than a one-off exercise. The assessor will want your two most recent dated risk registers to see how often they are updated.
1200.2 · MOD 000020 · Levels 1–3
Does each identified risk have a named owner?
A risk owner is responsible for tracking the risk and seeing that remediation happens within the agreed timescale. Provide a document listing your risks alongside their owners.
1201.1 · MOD 000021 · Levels 2–3
Do you keep a central cyber risk register that records each risk, names its owner and is reviewed regularly?
A risk register tracks what could go wrong, how likely and damaging it would be, and what you are doing about it. The assessor will usually ask for your last two versions to confirm it is kept up to date.
1202.1 · MOD 000370 · Levels 1–3
How often do you carry out a full risk assessment covering your operations, assets, people and the way your systems store and transmit data?
This looks at whether you regularly step back and assess risks to the business as a whole, including non-cyber risks such as fire or flood. Provide at least your two latest risk assessments to show it is a repeated activity.
1203.1 · MOD 000025 · Levels 1–3
Do you keep current network diagrams that show your network boundaries, internal and external connections and the systems you operate?
Diagrams should show the relevant systems, connections and network devices, where system boundaries and operating environments sit, how you connect to other systems, and be updated whenever these change. Provide your latest diagram or diagrams; they also form part of your scoping statement.
1204.1 · MOD 000026 · Level 3
Do you have a threat intelligence capability in place?
This might be your own team, a shared function or a managed service that follows threat feeds, works out what new information means for your network and records the action taken, such as patching, enriching SIEM data or briefing staff. Show the roles or job descriptions responsible for it.
1205.1 · MOD 000417 · Levels 2–3
Do you have an assurance process for checking that your security measures work across all your functions?
Assurance means getting evidence that controls are effective, for example through certification, audit or testing. The assessor will expect to see the certificates and reports behind your answer.
1205.2 · MOD 000418 · Levels 2–3
Do you regularly carry out assurance activities on the systems that store and process data?
This checks that assurance is repeated rather than done once. The simplest evidence is the output of those activities, such as test or audit reports.
1205.3 · MOD 000419 · Levels 2–3
Do you use what assurance activities find to improve the security of your people, processes and technology?
Assurance only adds value if its findings lead to change. Be ready to point to something specific you changed because of an assurance result.
1205.4 · MOD 000420 · Levels 2–3
Do you have a way of dealing with gaps found during assurance activities?
Gaps found in testing or review should be tracked through to a fix. Useful evidence includes gap reports, meeting minutes and records showing how each gap was closed.
1205.5 · MOD 000421 · Levels 2–3
Have you obtained independent reports or certifications that show your technology, people and processes are secure?
This looks for validation from an outside party rather than your own view. Provide the relevant certificates and independent reports.
1206.1 · MOD 000371 · Levels 2–3
How often do you internally assess whether your information security controls are working?
This is about structured reviews against a standard or framework, not everyday dashboards, log checks or routine policy edits. Provide records showing when these assessments took place.
1206.2 · MOD 000372 · Levels 2–3
Which of these form part of that internal assessment?
  • Checking controls work as your security policies require
  • Identifying weaknesses
  • Reporting results to leadership
An internal review should test controls against your own policies, record shortcomings and make sure leadership sees the results. A document describing the review's scope and method, or a findings report showing who received it, is typical evidence.
A3 Asset management 0/4 ▼
1300.1 · MOD 000031 · Levels 1–3
Do you have a written asset management policy?
A good policy explains how you identify and categorise your important assets, give each one an owner, track and protect them and dispose of them safely, in line with recognised good practice. Provide a policy that covers the whole asset lifecycle.
1300.2 · MOD 000033 · Levels 1–3
Do you have a process for classifying assets, including defining asset types and their value?
Classifying assets tells you which ones matter most and need the strongest protection. Provide the policy or other material showing how assets are classified.
1300.3 · MOD 000373 · Levels 1–3
Is everything needed to run your networks and information systems recorded in an asset inventory, including people, systems and supporting infrastructure?
You cannot protect what you have not recorded, and supporting infrastructure such as power and cooling counts as well as IT. Provide your asset register or equivalent record.
1301.1 · MOD 000374 · Levels 2–3
Do you use automated tools to discover and manage assets so your inventory stays current?
An automated tool should find devices on your network, including remote and off-site ones, and record details such as device type, IP and MAC addresses, operating system, software versions and last user login. Scans should run regularly. Expect to show a screenshot and then demonstrate the tool live.
A4 Supply chain 0/8 ▼
1400.1 · MOD 000630 · Levels 1–3
Do you have policies and procedures for managing the cyber security requirements of your supply chain?
Attackers often target suppliers to reach their customers, so supplier security needs a defined approach. Provide the relevant policies and procedures.
1400.2 · MOD 000375 · Levels 1–3
Do you assess the security risks that come from depending on your suppliers?
This checks that supplier dependencies are part of your risk thinking. An example of a recorded risk relating to a supplier is good evidence.
1400.3 · MOD 000376 · Levels 1–3
When do you assess security risks relating to your suppliers?
  • Before choosing a supplier
  • At least annually for every existing supplier
Supplier risk should be checked both before you sign up and periodically afterwards. Provide sample risk assessments for a new supplier and an existing one.
1400.4 · MOD 000377 · Levels 1–3
Which of these do you do to make sure suppliers keep suitable security measures in place?
  • Set security requirements for your supply chain
  • Check supplier contracts meet those requirements
  • Monitor suppliers' security arrangements
This checks you both set expectations and follow them up. The assessor will want evidence for each practice you select.
1400.5 · MOD 000378 · Levels 1–3
What do you do when a supplier does not meet your security requirements?
There should be a clear response when a supplier falls short. Provide an example of a supplier failing to meet requirements and what you did, or the policy setting out the actions you would take.
1401.1 · MOD 000036 · Levels 1–3
Are service level agreements with your IT infrastructure suppliers clearly documented?
Documented agreements make clear what service and response times you can rely on. Provide a sample contract showing the agreed timescales.
1401.2 · MOD 000040 · Levels 1–3
Do your supplier agreements include requirements for information security, confidentiality and data protection?
Security and privacy expectations should be written into what suppliers sign. Provide examples such as contract clauses or SLAs setting out these requirements.
1401.3 · MOD 000379 · Levels 1–3
Do you place restrictions on every subcontractor that handles customer data to stop it being shared without authorisation?
Customer data passed to subcontractors must stay under control. Provide sample agreements showing the limits placed on how they handle and share data.
A5 Physical security 0/9 ▼
1500.1 · MOD 000044 · Levels 1–3
Do you have a written physical security policy?
Physical access can undermine or bypass many technical controls, so it needs its own policy. Provide a copy of the policy.
1500.2 · MOD 000380 · Levels 1–3
Is physical access to places where sensitive data is stored or processed limited to authorised people?
Controls might include swipe cards, locks, alarms, CCTV or guards. Show how access is restricted, for example through the policy, a description or a photo of the lock or entry system.
1500.3 · MOD 000381 · Levels 1–3
Do you keep records of every instance of physical access to places where sensitive data is stored or processed?
Access records let you see who entered and when, and should be reviewed regularly or after an incident. A sample from your door entry system or sign-in log is suitable evidence.
1501.1 · MOD 000382 · Levels 1–3
Do you carry out any functions or process any data from premises of your own?
This establishes whether the physical premises controls apply to you. If you work from somewhere you do not control, explain the arrangement; relevant workplace security or acceptable use policies can support your answer.
1501.2 · MOD 000047 · Levels 1–3
Do you keep an inventory of every physical access device used at your premises, such as RFID cards, fobs, door keys, keypads or biometric scanners?
Each device should have a unique identifier and the name of the person it is issued to, so lost or unreturned devices can be traced. Provide the register or list.
1502.1 · MOD 000048 · Levels 1–3
Is physical access to sensitive areas limited to authorised people only?
Sensitive areas include server rooms, plant rooms and anywhere confidential work or data is held. Show how access is restricted, for example an access policy or a register of keys or tokens and who holds them.
1502.2 · MOD 000049 · Levels 1–3
Do you keep a current list of the people authorised to enter sensitive areas?
The list should change when people join, move role or leave. Provide the process for updating it and a sample or screenshot of the list.
1503.1 · MOD 000050 · Levels 1–3
Do you control visitor access to non-public parts of your premises, including recording when visitors arrive and leave?
Visitors should be escorted and their movements recorded. Provide your visitor record, or records if you have more than one level of access. If you use no office premises, say so.
1503.2 · MOD 000051 · Levels 1–3
Must visitors wear approved identification badges at all times while on your premises?
Visitor badges should be clearly different from staff badges and handed back at the end of the visit. Provide your visitor or admission policy.
B1 Resilience policy 0/3 ▼
2100.1 · MOD 000384 · Levels 1–3
Do you have written policies and procedures that address both cyber security and cyber resilience?
This checks that your approach to staying secure, and to withstanding or recovering from attacks and failures, is written down rather than informal. An assessor will usually ask to see the documents you rely on for each area.
2100.2 · MOD 000386 · Levels 1–3
When did you last review the policies and processes you use for cyber security and cyber resilience?
This checks that the documents are kept current through a regular review cycle of no more than a year. An assessor will usually look for a revision history, change log or review record on the same documents.
2101.1 · MOD 000385 · Levels 2–3
Which of these prompt you to update the policies and processes covering cyber security and cyber resilience?
  • Significant changes within the organisation
  • Changes in cyber security and resilience risks
  • New or changed laws and regulations that apply to you
  • New or changed contractual obligations
This checks that your policies respond to events, not just the calendar. For each one you select, be ready to show where it led to a review or change, for example through document version history or review notes.
B2 Identity and access 0/38 ▼
2200.1 · MOD 000392 · Levels 1–3
Do you have written policies and procedures covering how identities are managed?
This checks that you have a documented approach to creating, maintaining and retiring identities for people and systems. An assessor will usually want to see the relevant policy or procedure.
2200.2 · MOD 000393 · Levels 1–3
Do you have written policies and procedures covering access control?
This checks that the rules for who can access what, and how access is granted and removed, are written down. An assessor will usually want to see the relevant policy or procedure.
2200.3 · MOD 000394 · Levels 1–3
Which of these do you make sure of before giving anyone access to non-public resources?
  • The user is authenticated
  • The user is authorised
  • The user's identity has been verified
This checks that people are confirmed to be who they claim, and approved for the access they need, before they reach anything non-public. Be ready to walk an assessor through the steps you follow and show them working.
2201.1 · MOD 000387 · Levels 2–3
Which of these are protected by multi-factor authentication (MFA)?
  • Every system you consider critical
  • Every system that handles sensitive information
This checks that MFA covers your most important and sensitive systems. An assessor will usually expect screenshots of the security settings showing MFA switched on for each system.
2201.2 · MOD 000388 · Levels 2–3
On those systems, in which of these cases must MFA be completed before access is allowed?
  • Access from remote locations
  • Access to privileged or administrator functions
  • Access to sensitive information
This checks that MFA is enforced, not optional, in the higher-risk situations. An assessor will usually want configuration screenshots or policy documents showing enforcement for each case you select.
2202.1 · MOD 000389 · Levels 2–3
Which of these do you do so that only trusted devices can reach your trusted networks and systems?
  • Give each endpoint device its own identity
  • Explicitly approve each identified endpoint
  • Only approve devices that have a business need
  • Use endpoint security software to enforce security policies
  • Remove approval for trusted endpoints no longer needed
  • Block unapproved endpoints from trusted resources
  • Withdraw approval from endpoints that are compromised
  • Regularly re-check the reasons for trusting each endpoint
  • Monitor how endpoints are configured and used
This checks that you know every device that connects and only trust the ones you should. An assessor will expect evidence matching each practice you select, such as a device management policy or screenshots of security tooling enforcing your rules.
2203.1 · MOD 0000390 · Levels 2–3
Which of these do you do to manage privileged accounts and what they are used for?
  • Keep records of all privileged accounts
  • Re-check the need for each privileged account at least quarterly
  • Re-check privileged accounts when someone moves role or leaves
  • Log what privileged users do
  • Review privileged activity at least quarterly to confirm it is legitimate
This checks that high-level accounts are justified, tracked and watched. Useful evidence includes your list of privileged accounts, records of review meetings, version histories and activity logs.
2203.2 · MOD 000391 · Levels 2–3
Which privileged user activities do you log?
  • Sign-in attempts
  • Commands run
  • Changes to systems
  • Access to sensitive resources
This checks how much of what privileged users do is recorded. An assessor will usually want to see log entries showing each type of activity you select being captured.
2204.1 · MOD 000395 · Levels 1–3
Do you remove or restrict functions your information systems don't need?
This checks that systems only run the features, services, ports and protocols they actually require, which shrinks what an attacker can use. An assessor will usually look for evidence of switched-off functionality in hardening settings, configuration baselines, group policy or configuration management tools.
2205.1 · MOD 000068 · Levels 1–3
Is user access to resources granted on the basis of business need, following the least privilege principle?
This checks that people and programs get only the access their work requires, which limits the damage malware or a compromised account can do. An assessor will usually want you to show how access is controlled, either the mechanisms in place or the approach you follow.
2206.1 · MOD 000070 · Levels 1–3
Is access to your audit and security logging data limited to privileged groups with a confirmed need for it?
This checks that logs, which record what happened on your systems, can only be read or changed by those who genuinely need to. An assessor will usually want to see your policy on this and how it is enforced, for example role-based access settings or an access control list.
2207.1 · MOD 000396 · Levels 1–3
Does your access control policy set out an approach to separation of duties? (Small and micro organisations may define this as something applied once they grow.)
This checks that no single person can complete a sensitive process alone, and that admin accounts are kept apart from everyday accounts. An assessor will usually want to see the part of your access control policy that deals with this.
2207.2 · MOD 000397 · Levels 1–3
Which of these does your separation of duties approach take into account?
  • When duties need to be separated
  • How standard and privileged accounts are set up to support separation
  • How duties are covered while staff are absent
This checks how thoroughly your separation of duties approach has been thought through. An assessor will usually look at the relevant section of your access control policy for each point you select.
2208.1 · MOD 000398 · Levels 2–3
Which of these do you use to manage identity and access for users, administrators, devices and systems reaching your non-public networks and systems?
  • Authentication of each entity
  • Authorisation of what each entity can access
  • Recording and tracking of activity
This checks your identity and access lifecycle across who is let in, what they can reach and how their activity is tracked. An assessor will usually want examples of the tools, policies or processes behind each point you select, such as single sign-on, role-based access or audit logging.
2208.2 · MOD 000074 · Levels 2–3
Do you keep an inventory of every service account?
This checks that accounts used by software rather than people are known and tracked from creation to removal. An assessor will usually ask to see the inventory.
2208.3 · MOD 000399 · Levels 2–3
On your critical or sensitive systems, which of these are automated?
  • Alerting administrators when accounts are changed
  • Alerting administrators when system accounts are used unusually
This checks that account changes and odd account behaviour are flagged automatically rather than found by chance. An assessor will usually want to see an example alert and the configuration that produces it.
2208.4 · MOD 000400 · Levels 2–3
Which of these are automated in your organisation?
  • Telling the right people when staff leave or change role
  • Creating accounts on sensitive or critical systems
  • Removing accounts on sensitive or critical systems
This checks that joiner, mover and leaver changes flow through to accounts reliably. An assessor will usually want to see the tools involved, example notifications and the configuration or workflows.
2209.1 · MOD 000648 · Level 3
Do you use automated tools to help manage system accounts, including processes that act for authorised users?
This checks that accounts which run automated tasks, rather than being used by people, are managed and watched throughout their life so they can't be quietly misused. An assessor will usually want to see the tool or its configuration, an example of it working and how it is looked after.
2210.1 · MOD 000401 · Levels 1–3
Do you have a documented process for the full lifecycle of identities and credentials (issuing, managing, checking, withdrawing and auditing) used by authorised users, processes and transactions?
This checks that account and credential lifecycles follow a defined process, including not reusing old identifiers too soon after an account is closed. An assessor will usually ask for a copy of the process.
2210.2 · MOD 000402 · Levels 1–3
Have you put measures in place so that only authorised people and processes can use issued identities and credentials to access systems?
This checks that accounts can only carry out the actions they are permitted to, and that attempts beyond that are refused. An assessor will usually look at audit log entries showing both successful and refused actions.
2211.1 · MOD 000079 · Levels 1–3
Are first-time and one-time passwords stored, sent and managed securely?
This checks how initial passwords are protected before and during handover to a new user. An assessor may want to see your approach for each of storage, sending and management, plus how it is applied technically.
2211.2 · MOD 000080 · Levels 1–3
Must first-time and one-time passwords be changed straight after the first sign-in?
This checks that temporary passwords stop working as soon as they have been used once. Depending on how you enforce it, an assessor will want to see the policy or a demonstration or screenshot of the setting in your directory or identity platform.
2212.1 · MOD 000470 · Levels 2–3
Which of these do you use to protect passwords automatically?
  • Password hashing
  • Automated checks against password policy
  • Account lockout rules
  • Password manager tools
  • Password generators
This checks how much of password handling is done by tools rather than relying on people. An assessor will usually want to see your password policy or process, tool configuration and records of checks carried out.
2213.1 · MOD 000403 · Levels 1–3
Does your password policy require systems to enforce a minimum length of at least 8 characters for standard user passwords?
This checks the minimum password length you enforce; current NCSC guidance should be followed where your systems allow more. An assessor will usually ask for a copy of the policy.
2213.2 · MOD 000404 · Levels 1–3
Does your password policy stop users reusing any of their last 5 passwords, at least?
This checks that users can't simply cycle back to a recent password. An assessor will usually ask for a copy of the policy.
2214.1 · MOD 000407 · Levels 1–3
Do you have policies and procedures for dealing with failed sign-in attempts?
This checks that you have a defined approach to repeated failed logins, such as throttling and lockout. An assessor will usually ask for a copy of the relevant documents.
2214.2 · MOD 000408 · Levels 1–3
Do you have automated mechanisms that spot and respond to repeated failed sign-in attempts?
This checks that repeated failures are handled by the system, not left to chance. An assessor will usually want to see how the mechanism is configured and a demonstration of an account failing to sign in.
2214.3 · MOD 000410 · Levels 1–3
Are failed sign-in attempts monitored and reviewed regularly for signs of suspicious activity?
This checks that someone looks at failed logins for patterns that could indicate an attack. An assessor will usually want to see how you monitor sign-in activity and may ask what signs you look for.
2214.4 · MOD 000411 · Levels 1–3
Is a named person or team responsible for dealing with failed sign-in attempts?
This checks that ownership for this is clear. Have the person's or team's contact details ready, as an assessor may want to speak to them.
2214.5 · MOD 000405 · Levels 1–3
For a standard user account, how many wrong passwords can be entered before it locks?
This checks how quickly an account is locked when someone keeps guessing its password. An assessor will usually want to see the lockout setting and may ask for a demonstration of an account being locked.
2214.6 · MOD 000406 · Levels 1–3
How long does a user account stay locked after failed sign-in attempts?
This checks that a lockout lasts long enough to slow down password guessing. An assessor will usually want to see how the lockout is configured.
2214.7 · MOD 000089 · Levels 1–3
Does the lockout period get longer if failed sign-in attempts continue?
This checks that repeated lockouts become progressively longer, which makes sustained guessing impractical. An assessor will usually want to see how the lockout is configured.
2215.1 · MOD 000090 · Levels 1–3
Do you have technical controls that prevent replay attacks?
A replay attack is where an attacker captures sign-in or access data in transit and resends it to get in. This checks which countermeasures you use; supporting evidence could include penetration test or vulnerability scan results.
2216.1 · MOD 000091 · Levels 2–3
Are standard users prevented from running privileged functions?
This checks that actions reserved for privileged accounts simply won't run for anyone else. An assessor will usually want to see the tools or settings that enforce this.
2216.2 · MOD 000467 · Levels 2–3
Do you log attempts by non-privileged users to use privileged functions?
This checks that blocked attempts to use privileged functions are recorded so they can be investigated. An assessor will usually ask to see example log entries.
2217.1 · MOD 000093 · Levels 1–3
Do you keep an inventory of every generic, service and system account?
This checks that shared and non-human accounts are known and tracked. An assessor will usually want to see how the inventory is kept.
2217.2 · MOD 000094 · Levels 1–3
Does each generic and system account have one named person responsible for it and how it is used?
This checks that every non-personal account has a clear owner who is accountable for it. An assessor will usually want to see a named owner recorded against each account.
2218.1 · MOD 000095 · Levels 1–3
Can you tell apart system accounts and processes acting for real users?
This checks that every user, process working on a user's behalf, and device interacting with your systems can be uniquely identified. An assessor will usually want to see the tools that support this, and screenshots of how they are configured and used for monitoring.
B3 Data security 0/68 ▼
2300.1 · MOD 000642 · Level 1
Have you identified and documented which of your data fits each of these descriptions?
  • Your functions depend on it to operate
  • Unauthorised access, changes or deletion could cause harm
  • It could help an attacker, such as network or system designs
This checks that you know which data matters most and why. An assessor will usually look for a documented record, such as a data register or classification schedule, showing which data falls into each category.
2300.2 · MOD 000646 · Level 1
Where none of those descriptions applied, do your policies make sure only authorised users, devices and systems can reach that data?
This looks at whether data outside the critical categories is still limited to people, devices and systems with permission. Expect to show the relevant access policy and how it is applied, for example group memberships or permission settings.
2300.3 · MOD 000647 · Level 1
If you chose none of the descriptions in 2300.1, do you have technical and procedural measures protecting that data from unauthorised access, changes or deletion?
This checks that even lower-risk data has practical protection against tampering, loss and misuse. An assessor may ask to see access controls, backup arrangements and the procedures staff follow.
2301.1 · MOD 000412 · Levels 2–3
Do you know and understand which data your functions rely on?
This checks that you have worked out which data is essential to running the business. Evidence is usually a data inventory or classification record, and staff being able to explain it.
2301.2 · MOD 000413 · Levels 2–3
When classifying data, which of these impacts does your approach take into account?
  • Access by someone not authorised
  • Changes made without authorisation
  • Data becoming unavailable
This looks at whether your classification scheme weighs the harm from each kind of compromise. An assessor will typically want to see the classification policy or scheme and how impact levels are set.
2301.3 · MOD 000414 · Levels 2–3
Do you keep an inventory showing where your data is held?
This checks that you know every place data is stored, including cloud services and physical locations. Expect to show the inventory and how it is kept up to date.
2301.4 · MOD 000415 · Levels 2–3
Do you understand how your data moves, both inside the organisation and out to third parties?
This looks at whether you have mapped data flows, including transfers to suppliers and partners. Data flow diagrams or a documented flow register are typical evidence.
2302.1 · MOD 000416 · Levels 2–3
Have you worked out and recorded what encryption is needed for all data while it is being transferred?
This checks that you have assessed data in transit and decided where encryption is needed. An assessor will usually ask for the assessment or policy that sets out these requirements.
2302.2 · MOD 000422 · Levels 2–3
Which of these transfer routes did your assessment of encryption needs for data in transit cover?
  • Across the internet
  • Inside your own networks and systems
  • On removable media
This checks that your assessment covered every route data travels, not just internet traffic. Expect to show the assessment and where each route is addressed.
2302.3 · MOD 000423 · Levels 2–3
Is TLS 1.1 or any earlier version used anywhere to protect sensitive data in transit?
This checks for outdated TLS versions, which have known weaknesses. An assessor may look at server and service configurations or scan results showing which protocol versions are enabled.
2302.4 · MOD 000104 · Levels 2–3
When storage media or equipment holding data is physically moved, do you protect it?
This covers data leaving a site on drives, laptops or other media. Evidence might be a procedure for transporting media, use of encryption, tracked couriers or sealed containers.
2303.1 · MOD 000424 · Levels 1–3
In which of these situations must network connections be closed?
  • When the session ends
  • After a set period of inactivity of 24 hours or less
This checks that idle or finished sessions do not stay open for misuse. An assessor will usually want to see timeout settings in the relevant systems and the policy that sets them.
2304.1 · MOD 000425 · Levels 1–3
On all trusted organisational wireless networks, must users and devices be authenticated and authorised before they are allowed on?
This checks that nobody joins your trusted Wi-Fi without being identified and approved. Expect to show wireless configuration, for example enterprise authentication or certificate settings.
2304.2 · MOD 000426 · Levels 1–3
Is WPA2 or a newer encryption standard required on every trusted organisational Wi-Fi network?
This checks that Wi-Fi traffic is protected with a current encryption standard. Screenshots of access point or controller security settings are typical evidence.
2304.3 · MOD 000468 · Levels 1–3
Must visitors whose devices are not trusted use a separate wireless network kept apart from your trusted networks?
This checks that guest devices cannot reach internal systems. An assessor may look at the guest network setup and how it is segregated, such as VLAN or firewall rules.
2305.1 · MOD 000427 · Levels 1–3
Do users connecting remotely to your networks and systems have to use multi-factor authentication?
This checks that remote access needs more than a password. Expect to show VPN or remote access settings that enforce MFA and, if asked, a demonstration of a login.
2305.2 · MOD 000112 · Levels 1–3
Is all data sent over your VPN connections encrypted?
This checks that remote access traffic cannot be read in transit. VPN configuration showing the encryption settings is the usual evidence.
2305.3 · MOD 000428 · Levels 1–3
For remote users, is split-tunnelling switched off so that all data travels only over channels you control?
This checks that remote devices cannot send company traffic directly to the internet, outside your controls. An assessor will usually want to see the VPN client or gateway setting that disables split-tunnelling.
2306.1 · MOD 000429 · Levels 1–3
Are remote access sessions protected with cryptography?
This checks that the content of remote sessions stays confidential. Evidence is typically the configuration of VPN, remote desktop or similar tools showing encryption in use.
2307.1 · MOD 000115 · Levels 1–3
Does every remote access connection pass through access control points that you manage?
This checks that remote access comes in through a small number of controlled gateways rather than many direct routes. Expect to show a network diagram and gateway configuration.
2308.1 · MOD 000439 · Levels 2–3
Which of these threats have you put suitable controls in place against, to keep stored confidential data safe?
  • People breaking in
  • People nearby who could see it
  • Threats from within the organisation
This checks that protection of stored data considers outsiders, onlookers and insiders. An assessor may look at physical security, access restrictions and storage arrangements for both paper and electronic data.
2308.2 · MOD 000440 · Levels 2–3
Must staff keep confidential data only in approved storage locations?
This checks that confidential data is not scattered across unapproved places. Evidence is usually a policy naming approved locations and how staff are told about it.
2308.3 · MOD 000442 · Levels 2–3
Do you label assets so staff can keep track of those holding confidential data?
This checks that items containing confidential data are easy to identify and follow. Expect to show labelling practice, for example asset tags or protective markings.
2308.4 · MOD 000441 · Levels 2–3
Do staff who must store confidential information have enough secure storage provided for it?
This checks that the organisation gives people the means to store confidential material safely, such as lockable cabinets or controlled storage areas. An assessor may ask to see these facilities or records of them.
2308.5 · MOD 000438 · Levels 2–3
Where needed to keep data at rest confidential, have you applied full disk encryption to storage?
This checks that stored data is unreadable if a disk or device is taken. Evidence is usually encryption status reports or management console screenshots.
2308.6 · MOD 000443 · Levels 2–3
Have staff been trained in how to handle the storage of confidential data?
This checks that people know the rules for storing confidential data. Expect to show training material and records of who has completed it.
2309.1 · MOD 000430 · Levels 2–3
Do all mobile devices that process data have full device encryption?
This checks that data on phones and tablets is protected if a device is lost. Evidence is typically device management reports showing encryption status.
2309.2 · MOD 000464 · Levels 2–3
Do you configure and manage mobile devices remotely so you can do each of the following on those that access your secure environment or data?
  • Limit data access to authorised users and apps
  • Require a passcode and biometrics before data can be accessed
  • Remove data securely
  • Enforce a minimum patch level for devices and apps
  • Detect bypassed security features, such as jailbreaking or rooting
  • Manage apps that hold data
  • Check that apps comply with organisational policy
  • Confirm full device encryption is on
  • Enforce minimum inactivity locks for apps and devices
This checks the range of controls your device management gives you over mobile devices. An assessor will usually look at the management console and the policies applied to devices.
2310.1 · MOD 000122 · Levels 1–3
Do you keep an inventory of all the removable storage media and devices (RSM&D) you manage?
This checks that you know what removable media you own and who has it. Expect to show the inventory and how issue and return are recorded.
2310.2 · MOD 000639 · Levels 1–3
Which encryption algorithms do you use on the removable storage media and devices (RSM&D) you manage?
This checks that removable media is encrypted with a recognised strong method. FIPS-140-2 has been replaced by a newer version, so use the latest supported version where you can and AES-256 as a minimum, and plan to update products before they reach end of life without losing protection. Evidence is usually the product settings or specification.
2310.3 · MOD 000432 · Levels 1–3
Which of these do you do to control removable storage media and devices (RSM&D)?
  • Give read/write access only to authorised RSM&D
  • Stop staff and visitors using RSM&D that is not authorised
This checks that only company-owned or approved media can be read or written to, and other media is blocked. An assessor will usually want to see device control settings and the policy staff are given.
2311.1 · MOD 000126 · Levels 1–3
Do you keep an up-to-date list of approved working locations away from your premises and tell all staff what they are?
This checks that staff know where they are allowed to work outside the office. Expect to show the list, when it was last updated and how it is communicated.
2312.1 · MOD 000433 · Levels 1–3
Where staff work somewhere with an unacceptable risk of being overlooked, do you give them privacy screens for their devices?
This checks protection against shoulder surfing in public or shared spaces. An assessor may ask for purchase or issue records, or the policy on when screens are used.
2312.2 · MOD 000128 · Levels 1–3
Does your security awareness training cover the risks of working away from your premises?
This checks that staff understand the dangers of remote working, such as public Wi-Fi, being overheard or leaving devices unattended. Expect to show the training content and completion records.
2312.3 · MOD 000434 · Levels 1–3
For endpoints whose remote users are at risk, do you enforce an always-on VPN?
This checks that at-risk devices always send traffic through a protected connection. Evidence is usually the VPN client configuration and the policy defining which devices need it.
2312.4 · MOD 000435 · Levels 1–3
Do you manage and restrict peripherals and media connecting to physical ports (for example USB, card readers or network ports) unless policy authorises it, using technical controls as well as policy and process?
This checks that port use is locked down in practice, not just in policy. An assessor will usually want to see device control or endpoint management settings alongside the policy.
2312.5 · MOD 000436 · Levels 1–3
On laptops and other portable devices, do you assess the risk of each USB or other physical port and disable any that are not needed?
Some roles, such as penetration testers, may be permitted enabled ports to do their work, but roles that do not need them should have them disabled by default, and you need a way of assessing the risk of enabling a port. Evidence is typically the default device configuration, a list of approved exceptions and the risk assessment method.
2312.6 · MOD 000437 · Levels 1–3
Is full disk encryption in place on every device staff use when working away from your premises?
This checks that data on devices taken out of the office is protected if lost or stolen. Expect to show encryption status from your device management or security tools.
2313.1 · MOD 000132 · Levels 2–3
Before devices, equipment and removable storage media are reused or disposed of, are they sanitised?
This checks that data cannot be recovered from kit that is reused or thrown away. An assessor will usually ask for the procedure and records or certificates of sanitisation.
2313.2 · MOD 000133 · Levels 2–3
Which of these do your decommissioning and destruction policy, standards and procedures cover?
  • Secure removal and destruction of information according to how sensitive it is
  • The type of medium, such as paper, tape or disk
This checks that your disposal approach matches the method to both the sensitivity of the data and the kind of media. Expect to show the relevant policy and procedures.
2313.3 · MOD 000444 · Levels 2–3
For assets holding confidential information, does your disposal process ensure each of the following?
  • Assets waiting for disposal are suitably labelled
  • Proof of sanitisation or destruction is obtained
  • Identifying labels are taken off at disposal
  • Disposal records are kept
This checks that disposal is controlled and traceable from start to finish. An assessor will usually look at disposal records, destruction certificates and how assets are marked while waiting.
2314.1 · MOD 000447 · Levels 0–3
Do you have documented policies and procedures that make sure you meet your UK GDPR obligations?
This checks that data protection duties are written down and followed. Expect to show the relevant policies, such as your data protection policy and procedures for handling personal data.
2314.2 · MOD 000446 · Levels 0–3
Do you carry out Data Protection Impact Assessments (DPIAs) on the types of data you hold or process?
A DPIA can involve identifying processing activities, looking at the data types, spotting risks and impacts, reducing those risks and recording the results. An assessor will usually want to see completed DPIAs and how they are triggered.
2315.1 · MOD 000448 · Levels 1–3
Is DMARC in place for all of your internet-facing email services?
This checks that your domains publish a DMARC policy so receivers can deal with spoofed mail. DNS records and DMARC reports are typical evidence.
2315.2 · MOD 000449 · Levels 1–3
Is DKIM in place for all of your internet-facing email services?
This checks that outgoing mail is signed so recipients can confirm it came from your domain. Expect to show DKIM DNS records and signing settings.
2315.3 · MOD 000450 · Levels 1–3
Do your internet-facing email domains use SPF to guard against spoofing?
This checks that your domains list which servers may send mail on their behalf. The published SPF DNS records are the usual evidence.
2316.1 · MOD 000454 · Levels 1–3
For which of these types of information do you have procedures to identify and authorise how it flows?
  • Personal information received or created under a contract
  • Government information received or created under a contract
This checks that you know and approve where contract-related personal and government information goes. Expect to show the procedures and any approval records.
2316.2 · MOD 000455 · Levels 1–3
Must the flow of personal and government information be controlled in line with each of the following?
  • Approved authorisations
  • Relevant legislation
  • Contract requirements
This checks that data flows are governed by the right approvals, law and contract terms. An assessor will usually look at policy wording and examples of how flows are authorised.
2316.3 · MOD 000456 · Levels 1–3
Do your diagrams or records of approved personal and government information flows show movement between each of these?
  • Users
  • Systems
  • Networks
  • Jurisdictions
This checks how you map the approved movement of personal and government information. Data flow diagrams or a flow register are the typical evidence.
2316.4 · MOD 000457 · Levels 1–3
Do you use systems to control the approved flow of personal and government data?
This checks that the flows you have approved are enforced by actual mechanisms or tools, not just documented. An assessor may ask to see how those systems are configured.
2316.5 · MOD 000458 · Levels 1–3
Do you use systems to monitor flows of personal and government data to make sure they stay within what you have authorised?
This checks that tools or processes watch data movement and pick up anything outside approved flows. Expect to show monitoring configuration, alerts or reports.
2317.1 · MOD 000632 · Levels 1–3
Is full disk encryption applied and maintained on every endpoint?
This checks that laptops, desktops and other endpoints protect their data at rest. An assessor will usually want encryption status reports from your management tools covering all endpoints.
2317.2 · MOD 000459 · Levels 1–3
Which encryption algorithms do you use for full disk encryption on endpoints?
This checks that endpoint encryption uses a recognised strong algorithm. FIPS-140-2 has been superseded, so a newer version or AES-256 is preferred where possible. Evidence is usually the encryption product's configuration or specification.
2318.1 · MOD 000631 · Levels 1–3
Do you have a policy on how cryptographic methods are used?
This checks that the use of cryptography is governed by a written policy. Expect to show the policy and when it was last reviewed.
2318.2 · MOD 000633 · Levels 1–3
Which cryptographic methods do you use when encrypting data?
  • Methods approved under FIPS-140-2 or later
  • Methods approved by a national authority
This checks that encryption relies on approved, recognised methods. An assessor may look at product specifications or configuration showing the methods in use.
2319.1 · MOD 000460 · Levels 1–3
Which of these does your encryption key management policy and procedure cover?
  • Required key lengths
  • Secure storage, distribution and updating of keys
  • Revoking keys
  • Handling keys that are lost, corrupted or expired
  • Keeping backups of keys
  • Key activation and deactivation dates
  • Limiting key access to authorised people
  • Meeting local legal and regulatory rules on cryptography
This checks that keys are managed across their whole life. Expect to show the key management policy and procedures, and possibly settings in key management tools.
2320.1 · MOD 000469 · Levels 2–3
Which of these does your Data Loss Prevention (DLP) policy cover?
  • What information may be released
  • How data flows must be controlled
  • How attempts at unauthorised release are detected
This checks that your DLP policy sets out what may leave, how it is controlled and how leaks are spotted. An assessor will usually want to read the policy itself.
2320.2 · MOD 000461 · Levels 2–3
Which of these channels does your Data Loss Prevention (DLP) policy deal with?
  • Removable storage media and devices
  • External websites
  • Email
This checks that the main routes for data leaving the organisation are covered. Expect to show the policy and the sections dealing with each channel.
2320.3 · MOD 000462 · Levels 2–3
Do you use systems that enforce your DLP rules and raise alerts?
This checks that DLP rules are applied by tools and that breaches are flagged. Evidence is usually DLP tool configuration and example alerts.
2320.4 · MOD 000159 · Levels 2–3
Do you use automated search tools to find data held in unauthorised network drives or online or cloud storage?
This checks that you actively look for data sitting in places it should not be. An assessor may ask to see the tool, its scan scope and recent results.
2321.1 · MOD 000161 · Levels 1–3
Have you named the individuals who are authorised to make information publicly available?
This checks that only designated people can publish information. Expect to show a list of authorised publishers and how their access is controlled.
2321.2 · MOD 000162 · Levels 1–3
Do you train those designated individuals so that public information contains nothing that should stay non-public?
Training should cover areas such as data classification, privacy law, good security practice and how to recognise information that must not be released. Evidence is usually training content and completion records.
2321.3 · MOD 000163 · Levels 1–3
Before content is posted to a publicly accessible system, is it reviewed to confirm it holds no non-public information?
This checks for a check step before publication. An assessor may look at the review procedure and records of approvals.
2321.4 · MOD 000164 · Levels 1–3
Do you regularly go back over content already published on public-facing systems and take down any non-public information you find?
This checks that published content is revisited in case something has slipped through. Expect to show the review schedule and records of past reviews and any removals.
2322.1 · MOD 000463 · Levels 1–3
Is every mobile device that accesses your corporate environment or data suitably configured and managed with MDM or an equivalent tool?
This checks that mobile devices, including personal ones used for work, are brought under central management. An assessor will usually look at the MDM console and enrolled device list.
2322.2 · MOD 000169 · Levels 1–3
If a mobile device is lost or stolen, do you have a process to disable it or wipe organisation data from it?
This checks that you can act quickly to protect data on a missing device. Expect to show the procedure and the remote lock or wipe capability, for example in your MDM tool.
2323.1 · MOD 000465 · Levels 1–3
Do you have procedures that make sure all data is securely destroyed once it is no longer needed?
This checks that data is not kept or discarded carelessly after its useful life. An assessor will usually want to see the procedure and examples of destruction records.
2323.2 · MOD 000173 · Levels 1–3
Do you make sure third parties who process data for you dispose of it securely once it is no longer needed?
This checks that suppliers handling your data also destroy it properly. Evidence is typically contract clauses and any destruction confirmations received.
B4 System security 0/80 ▼
2400.1 · MOD 000466 · Levels 1–3
Have you identified which of your systems and technologies are critical to running your business functions and protecting data?
This checks that you know which systems matter most, so protection can be focused where it counts. An assessor will usually look for an inventory or register marking critical systems and the functions or data each one supports.
2400.2 · MOD 000640 · Levels 1–3
Do you protect your critical systems against cyber-attack with security measures chosen according to the risks to your business functions and data?
This checks that the defences on your critical systems follow from a real view of risk rather than being applied at random. Expect to show a risk assessment and how it links to the controls in place, such as hardening standards, firewalls or endpoint protection.
2401.1 · MOD 000649 · Levels 1–3
Do you have a way of configuring securely the networks and information systems that run your business functions and protect data?
This checks that systems are set up to a known secure standard, whether through build images, configuration scripts, infrastructure as code or a manual checklist. An assessor will usually want to see the baseline or build standard and evidence it is applied.
2401.2 · MOD 000XXX · Levels 1–3
Which of these do your secure configuration mechanisms cover?
  • Encryption of endpoints
  • Limits on writing to removable media, including mobile devices
  • A password-protected screen saver that starts after 15 minutes
  • Controls stopping users installing unapproved software
  • Limits on running privileged functions, such as editing the registry
This checks which specific hardening settings your configuration approach enforces. Screenshots of policy settings, group policy or device management profiles showing each setting are the usual evidence.
2401.3 · MOD 000XXX · Levels 1–3
Do you have mechanisms that keep secure configurations in place over time?
Settings can drift after they are first applied. This checks that you detect and correct drift, for example with compliance reporting in a device management tool, configuration monitoring or periodic checks against the baseline.
2402.1 · MOD 000473 · Levels 1–3
Do you have a process for managing vulnerabilities?
This checks that finding and fixing weaknesses in systems and applications is a defined, repeatable process with owners. An assessor will usually ask for the documented process and records showing it is followed.
2402.2 · MOD 000474 · Levels 1–3
When do you scan your systems for vulnerabilities?
  • At least once a month
  • After major updates to a system or application
This checks how often you look for new weaknesses, both on a regular cycle and when significant changes are made. Scan schedules, tool configuration and recent scan reports are the usual evidence.
2402.3 · MOD 000475 · Levels 1–3
Which of these does your vulnerability scanning cover in full?
  • Web services
  • Applications
  • Infrastructure and networks
This checks that scanning reaches every layer of your estate rather than only part of it. Expect to show scan scope or target lists and reports covering each area.
2402.4 · MOD 000183 · Levels 1–3
Do you create risk treatment plans to fix or mitigate vulnerabilities you find, and act on them promptly?
This checks that each vulnerability you find leads to a decision and action, either remediation or a mitigation. An assessor will usually look for treatment plans, tickets or a vulnerability register showing actions and dates.
2402.5 · MOD 000184 · Levels 1–3
Have you set timelines for dealing with vulnerabilities?
This checks that you have agreed how quickly vulnerabilities of each severity must be addressed. The usual evidence is a documented remediation timeline, often tied to CVSS severity ratings.
2402.6 · MOD 000476 · Levels 1–3
What is your timeline for addressing vulnerabilities rated critical under CVSS v3?
This checks how quickly your defined timeline requires the most severe vulnerabilities to be dealt with, using the Common Vulnerability Scoring System v3 ratings. Expect to show the documented timeline and records of fixes against it.
2402.7 · MOD 000477 · Levels 1–3
What is your timeline for addressing vulnerabilities rated high under CVSS v3?
This checks the remediation window your process sets for high-severity vulnerabilities as rated by CVSS v3. An assessor will usually compare the documented timeline with remediation records.
2402.8 · MOD 000478 · Levels 1–3
What is your timeline for addressing vulnerabilities rated medium under CVSS v3?
This checks the remediation window your process sets for medium-severity vulnerabilities as rated by CVSS v3. Expect to show the documented timeline and evidence it is met.
2402.9 · MOD 000479 · Levels 1–3
What is your timeline for addressing vulnerabilities rated low under CVSS v3?
This checks the remediation window your process sets for low-severity vulnerabilities as rated by CVSS v3. Expect to show the documented timeline and evidence it is met.
2403.1 · MOD 000480 · Levels 1–3
Are your externally facing systems penetration tested at least every 12 months?
This checks that the systems exposed to the internet are tested by simulated attack on a regular cycle. An assessor will usually want to see the most recent test reports and their dates.
2403.2 · MOD 000192 · Levels 1–3
Is your penetration testing programme built on industry standards and carried out by subject matter experts?
This checks that testing follows a recognised method and is done by people qualified to do it. Evidence usually includes the methodology referenced in reports and the tester's accreditation or qualifications.
2403.3 · MOD 000481 · Levels 1–3
Which of these do your penetration testing records contain?
  • Scope and method of the test
  • Findings broken down by severity
  • Who carried out the test (company or individual)
  • Date of the test
  • A remediation plan with deadlines
This checks that test records are complete enough to show what was tested, what was found and how it will be fixed. An assessor will usually review a recent test report and the linked remediation plan.
2404.1 · MOD 000482 · Levels 1–3
Do you have formal policies, processes and procedures for managing change?
This checks that changes to systems, infrastructure and facilities go through a defined, documented route. Expect to show the change management policy and procedures.
2404.2 · MOD 000483 · Levels 1–3
Do you review your change management policies, processes and procedures at least once a year?
This checks that change control documents stay current. Version history, review dates or approval records are the usual evidence.
2404.3 · MOD 000484 · Levels 1–3
Which of these does your change management policy include?
  • Who is responsible for what in change management
  • Categories of change, such as standard, normal and emergency
  • The processes and procedures each change must follow
This checks that your policy sets out who does what, how changes are classified and what steps apply. An assessor will usually read the policy to confirm each element is present.
2404.4 · MOD 000485 · Levels 1–3
Which of these do you do before a change is made?
  • Set acceptance criteria
  • Log the change in a central record
  • Analyse the business impact if the change fails
  • Analyse and record the security impact
  • Document any security mitigations needed
  • Document how to roll the change back
  • Get approval from stakeholders
This checks the checks and approvals a change passes through before it goes live. Evidence usually comes from sample change records in your ticketing or change tool showing each step.
2404.5 · MOD 000486 · Levels 1–3
Which of these do you keep as an audit trail for each change?
  • Testing history and documentation
  • Approvals
  • The result of the change
This checks that you can reconstruct what happened with a change after the event. An assessor will usually sample completed change records to confirm these details are retained.
2405.1 · MOD 000199 · Levels 1–3
Do you have a patch management policy and programme?
This checks that applying security updates is a defined and maintained programme rather than something done ad hoc. Expect to show the policy and evidence of the programme running, such as patch reports.
2405.2 · MOD 000487 · Levels 1–3
Do you monitor your technology vendors so you learn about updates for your endpoints, network devices and software in good time?
This checks that you find out quickly when vendors release updates. Subscriptions to vendor advisories, automated update feeds or a tracking process are the usual evidence.
2405.3 · MOD 000488 · Levels 1–3
Do you assess which vendor updates fix vulnerabilities?
This checks that you work out which updates are security fixes so they can be prioritised. An assessor may look at how releases are triaged and recorded.
2405.4 · MOD 000489 · Levels 1–3
Do you test patches before deploying them to critical production environments?
This checks that updates are tried out before reaching critical live systems, so a faulty patch does not cause an outage. Evidence usually includes test or pilot groups and records of testing.
2405.5 · MOD 000490 · Levels 1–3
Do you patch systems promptly, and within 14 days of the release of an update fixing a vulnerability the vendor rates as 'critical' or 'high risk'?
This checks how quickly the most serious security updates are actually applied. An assessor will usually compare update release dates with deployment records or patch compliance reports.
2405.6 · MOD 000491 · Levels 1–3
Do you have processes that allow emergency patching outside your normal patch cycle?
This checks that you can move quickly when an urgent fix or mitigation is needed between scheduled patch windows. Expect to show the emergency procedure and any examples of its use.
2406.1 · MOD 000650 · Levels 2–3
Do users have to accept an appropriate warning notice before they can access your systems?
This checks that a notice is displayed and must be acknowledged before system access. The usual evidence is a screenshot of the login banner or notice and the setting that enforces it.
2406.2 · MOD 000203 · Levels 2–3
Which of these do your warning notices tell users?
  • The system is monitored and recorded, and may be audited
  • Unauthorised use is not allowed
  • Unauthorised use can lead to criminal and civil penalties
  • Continuing means consenting to activity monitoring and recording
This checks that the notice covers each message users need to see before access. An assessor will usually read the notice text to confirm each point.
2407.1 · MOD 000204 · Levels 1–3
Where the UK or international partner nations require it, do users have to accept a warning notice before accessing systems with specific handling requirements?
This checks that systems holding information subject to UK or partner-nation handling rules display and require acknowledgement of a dedicated notice. Expect to show the notice and where it is configured.
2407.2 · MOD 000205 · Levels 1–3
For systems with handling requirements set by the UK or its international partners, which of these do your warning notices state?
  • The system holds information with requirements set by the UK or international partner nations
  • Some information may carry further requirements, such as export controls or licences
This checks that the notice explains the handling rules that apply. An assessor will usually read the notice wording on the relevant systems.
2407.3 · MOD 000492 · Levels 1–3
Are warning notices about specific handling requirements shown only to users who are authorised and authenticated?
This checks that the notice appears only after sign-in, so its content is not revealed to anyone who has not been verified. Evidence usually shows where in the login flow the notice appears.
2408.1 · MOD 000206 · Levels 1–3
Do user sessions lock automatically on all devices after a set period of inactivity?
This checks that unattended devices do not stay open for anyone to use. Screenshots of device policies or group policy settings enforcing the lock are the usual evidence.
2408.2 · MOD 000493 · Levels 1–3
How long is the inactivity period you have set before sessions lock?
This checks the timeout you have chosen. An assessor will usually confirm the value in the policy settings applied to devices.
2408.3 · MOD 000208 · Levels 1–3
Do locked sessions and lock screens hide everything that was previously on screen?
This checks that nothing sensitive stays visible once a device locks, including notification content such as email previews. Expect to show lock screen settings or a demonstration.
2409.1 · MOD 000209 · Levels 1–3
Do you keep an up-to-date list of approved software?
This checks that you know which programs are allowed to run in your environment. The usual evidence is the list itself and how it is kept current.
2409.2 · MOD 000210 · Levels 1–3
Is software that is not on your approved list blocked by default, with exceptions allowed only by permission?
This checks that unapproved programs cannot run unless an exception is granted. Evidence usually includes application control settings, such as allow lists, and the exception approval process.
2410.1 · MOD 000211 · Levels 1–3
Do you review your list of approved software at least every 90 days?
This checks that the approved software list stays accurate as needs change. Review records, dates or change history for the list are the usual evidence.
2411.1 · MOD 000494 · Levels 1–3
Which of these do your endpoint internet access controls block, in line with your internet access policy?
  • Malware infection through web browsing
  • Access to unwanted sites, such as malicious or inappropriate content
  • Web application software
  • Code running on the endpoint
  • Downloads that have not been sandboxed and scanned for malware
  • Suspicious traffic and communications
This checks which internet-related risks your endpoint controls actively stop. An assessor will usually look at web filtering, endpoint protection and firewall settings covering each item.
2411.2 · MOD 000495 · Levels 1–3
Where your policy allows any of these activities for business reasons, do you use processes and technologies to reduce the extra risk?
This checks that exceptions are backed by compensating measures, such as allow and block lists, network monitoring or vulnerability scanning. Expect to show the exceptions granted and the safeguards around them.
2411.3 · MOD 000496 · Levels 1–3
Is auditing turned on for your endpoint internet access controls?
This checks that activity against these controls is logged so it can be reviewed. Screenshots of logging settings or sample logs are the usual evidence.
2411.4 · MOD 000497 · Levels 1–3
Are security operators alerted when internet activity is blocked?
This checks that blocked attempts reach the people who can investigate them. An assessor may ask to see alert rules or examples of alerts received.
2411.5 · MOD 000498 · Levels 1–3
Do your systems close connections to internet resources when sessions end or after a set period of inactivity?
This checks that idle or finished connections do not stay open. Evidence usually includes session timeout settings on proxies, firewalls or endpoints.
2412.1 · MOD 000643 · Levels 1–3
Do you have a documented policy on using VoIP technologies?
VoIP here covers internet calling, meeting and collaboration tools, not only desk phones. This checks that you have written rules for their use; expect to show the policy.
2412.2 · MOD 000644 · Levels 1–3
Was your VoIP policy shaped by a risk assessment of how VoIP could be used maliciously?
This checks that the rules reflect the harm these tools could do if abused. An assessor will usually want to see the risk assessment and how it fed into the policy.
2412.3 · MOD 000645 · Levels 1–3
Which of these apply to all VoIP technologies in your organisation?
  • Approved before being deployed or used
  • Monitored for unauthorised or malicious use
  • Controlled, for example by firewall rules and endpoint controls
This checks that every VoIP tool is approved, watched and restricted. Evidence usually includes an approved tools list, monitoring configuration and firewall or endpoint rules.
2413.1 · MOD 000500 · Levels 1–3
Have you defined what use of mobile code is acceptable and what is not?
Mobile code is software delivered from a remote system and run locally without being installed, such as scripts, macros, JavaScript or plugins. This checks that you have set rules on it; expect to show the policy or standard.
2413.2 · MOD 000501 · Levels 1–3
Is mobile code in your organisation controlled so that you can find it, approve it, keep watch on it, review it and restrict its use?
This checks that your mobile code rules are enforced in practice. Evidence usually includes browser and application security settings, such as macro and script restrictions applied through group policy or device management.
2414.1 · MOD 000502 · Levels 1–3
Do you require secure communication protocols for sessions where authenticity matters, with weak or unencrypted protocols switched off?
Older protocols can be exploited, and unencrypted ones let anyone on the path read the traffic. This checks that your network management and communication sessions rely on current, secure protocol versions. An assessor will usually want to see your hardening standard or configuration policy plus screenshots showing insecure protocols disabled.
2415.1 · MOD 000220 · Level 3
Do you use automated tooling to find system components that are configured incorrectly?
Misconfiguration covers wrong settings, missing patches and anything that drifts from your approved standard, across hardware, software and firmware. One tool or several can do the job. Expect to show how the detection works in practice, such as tool settings and recent reports or logs of what it has found.
2415.2 · MOD 000651 · Level 3
When misconfigured components are found, are they handled through your vulnerability management process?
Detection only helps if findings lead to action. This checks that misconfigurations feed into your vulnerability management process and are followed through to a fix. An assessor will usually look for the documented process and records tracing a detected issue to its remediation.
2415.3 · MOD 000221 · Level 3
Do you use automated tooling to find system components that are not authorised to be there?
Unauthorised components include rogue or unapproved devices, software nobody sanctioned, and equipment on outdated firmware. This checks that something detects them automatically rather than relying on someone noticing. Be ready to show the tool configuration and evidence that it is running.
2415.4 · MOD 000503 · Level 3
Are unauthorised components that you detect dealt with through your incident management and change control processes?
Once an unapproved component turns up, it needs a defined response, for example isolation or removal, handled as an incident and recorded through change control. An assessor will usually want the procedure and examples such as incident reports or change records showing how past findings were resolved.
2416.1 · MOD 000504 · Levels 2–3
Have you put controls in place to stop information passing, without authorisation or by accident, through shared system resources?
Registers, cache, memory and disks are shared between processes and users, and without controls they can leak data. Relevant measures include access control, process isolation, virtualisation or containerisation, encryption and monitoring, and some may already be covered by other controls. Evidence might be policies, configuration screenshots, or training records.
2417.1 · MOD 000224 · Levels 1–3
Must remote users be authorised and approved before they can carry out privileged actions?
Remote access to privileged functions is a high-value target, so being connected should not be enough on its own. This checks that a separate authorisation step applies before anyone working remotely can use admin-level functions. An assessor will usually want your remote access policy and records of privileged-access requests and approvals.
2418.1 · MOD 000505 · Levels 1–3
Do all of your organisational systems have a defined baseline configuration?
A baseline is the approved standard build that each system should match. Products often ship with every service enabled and default admin accounts, so a baseline sets out how they should be configured instead. Expect to show a register of baselines and how they are decided.
2418.2 · MOD 000472 · Levels 1–3
Do your system baselines include hardening steps?
Hardening removes unnecessary services, default accounts and weak settings. This checks that those steps form part of the baseline rather than being done ad hoc. A sample baseline, or the procedure showing how hardening is applied to it, is the usual evidence.
2418.3 · MOD 000506 · Levels 1–3
Which of these do your baseline configurations restrict?
  • What users are able to do
  • Unsupported software and hardware
Baselines should limit user actions and keep out software and hardware that no longer gets vendor support. Tick each restriction your baselines actually enforce. An assessor will usually ask for example baseline configurations showing them.
2418.4 · MOD 000507 · Levels 1–3
Which of these apply to your baseline configurations?
  • Written down
  • Put into effect on systems
  • Revised whenever the baseline changes
  • Reviewed at least annually
A baseline needs to be recorded, actually applied, kept current and periodically reviewed. Tick every statement that is true. Evidence is usually the baseline policy or procedure plus version history showing updates and reviews.
2419.1 · MOD 000228 · Levels 1–3
Are passwords masked (for example as dots or asterisks) while users type them, rather than shown in readable text?
Visible passwords can be picked up by someone looking at the screen, by screen-capture malware, or during screen sharing. This checks that credential fields hide what is typed. An assessor will usually want a policy requirement and configuration settings or a demonstration showing it.
2420.1 · MOD 000508 · Levels 1–3
Do your systems give only generic feedback when a logon fails, without revealing which part of the credentials was wrong?
A message like "incorrect password" tells an attacker the username is valid, which helps them build lists of accounts to attack. This checks that login, password recovery and account set-up responses do not confirm whether an account exists. Expect to show this with a screenshot or live demonstration.
2421.1 · MOD 000509 · Levels 1–3
Do all your devices keep their clocks in sync using the Network Time Protocol (NTP)?
Consistent time across devices means log entries line up, which matters for audits, investigations and spotting attacks. The control expects every network device to sync to a recognised authoritative time source. An assessor will usually want a demonstration of the NTP service status and proof that devices are synchronising correctly.
2422.1 · MOD 000510 · Levels 1–3
Do you enforce physical and logical access restrictions on who can make changes to your systems, including upgrades and modifications?
Physical restrictions cover things like server rooms and racks; logical ones cover permissions, controlled workflows and change windows. This checks that both are enforced when systems are changed. Evidence might be access logs from change windows, records of temporary elevated privileges, and change management logs.
2422.2 · MOD 000511 · Levels 1–3
Are the physical and logical access restrictions for changing your systems defined, documented and approved?
Enforcement needs a written, signed-off basis. This checks that the change-related access restrictions exist as an approved document, usually a policy or procedure. The same restrictions evidenced for 2422.1 may already meet this.
2423.1 · MOD 000512 · Levels 1–3
Do you use automated tools to identify, record and maintain a trusted inventory of your critical system components?
Keeping the component inventory up to date automatically improves accuracy and supports knowing that software and firmware came from trusted sources. Endpoint and software asset management tools often provide this. An assessor will usually want to see the output of the tooling.
2423.2 · MOD 000513 · Levels 1–3
Which of these details do your inventories record?
  • Where each critical component is located
  • What each critical component does
  • Who owns the asset
  • Independently verified hash values for each image or software package
Location and ownership are the minimum the control expects, and function and hash values help confirm software is genuine and unaltered. Tick each detail your inventory holds. Expect to share a sample of inventory records and the procedure for deciding, checking and maintaining the data, including how hashing is done.
2424.1 · MOD 000514 · Levels 2–3
Are administrator credentials kept in an approved, secured storage mechanism?
Admin credentials give wide access, so where and how they are stored needs to meet a recognised standard and be protected. Typical mechanisms are password vaults, hardware security modules or encrypted stores. Evidence might include the storage policy, tool configuration and screenshots.
2424.2 · MOD 000515 · Levels 2–3
Do you audit at least quarterly that the controls for securely storing administrator credentials are applied and working?
Regular audits confirm the storage approach is still followed and effective. This checks the audits happen at least every quarter. An assessor will usually ask for audit reports or logs covering the past year.
2425.1 · MOD 000516 · Level 3
Do you use integrity verification tooling to catch unauthorised changes to web-facing and critical software and firmware?
Such tools compare files and firmware against a known-good baseline and flag differences. This checks the tooling exists and covers the right things, for example web application code, operating system and application binaries, and BIOS/UEFI. Be ready to show how it is configured and what it monitors.
2425.2 · MOD 000517 · Level 3
Does your integrity verification tooling start your incident response process automatically when it detects an unauthorised change?
A detected change should lead straight into incident handling without waiting for someone to notice an alert. This checks there is an automated link between the tool and your incident response process. Evidence could be an alert screenshot, logs of past triggered responses, or documentation of the integration.
2426.1 · MOD 000518 · Levels 1–3
Have you deployed anti-malware on your systems?
Devices that can reasonably run anti-malware should do so. This checks it is in place across your estate, including servers. Typical evidence is a security policy, build images or device configuration showing the product, and licensing.
2426.2 · MOD 000519 · Levels 1–3
Are anti-malware signatures and software updated promptly when new releases become available?
Out-of-date anti-malware misses new threats. This checks that both detection signatures and the product itself are kept current without delay. An assessor will usually look at configuration settings, update schedules and device management logs.
2426.3 · MOD 000520 · Levels 1–3
When you regularly audit your anti-malware, which of these do you check?
  • It is updated routinely and promptly
  • It is working, including real-time and scheduled scans
  • It is actively managed
  • It detects test malware samples
  • It reports detections correctly
Having anti-malware installed is not the same as knowing it works. Tick each aspect your regular audits confirm. Evidence might be audit reports, detection logs from test samples, incident reports or external testing.
2427.1 · MOD 000521 · Levels 1–3
Which of these do you do with communications at your external boundaries and key internal boundaries?
  • Control them
  • Monitor them
  • Protect them
Traffic entering and leaving your systems, including from remote staff, should be controlled, watched and protected at the boundary, except where applicable law prohibits monitoring. Tick each that applies. Expect to share network diagrams, remote working and security policies, and boundary device configuration.
2428.1 · MOD 000246 · Levels 1–3
Are connections to external systems controlled and limited by an allow-list at your network boundary?
An allow-list means only approved external destinations can be reached. This checks your boundary devices enforce one. An assessor will usually want the boundary configuration, an example of the list, and how it is decided, monitored and reviewed.
2429.1 · MOD 000522 · Levels 1–3
Are all inbound connections from external systems blocked unless they appear on an allow-list?
Default-deny for inbound traffic keeps exposure to what you have deliberately permitted. This checks that anything not explicitly approved is refused. Typical evidence is a network diagram of inbound entry points, boundary device configuration and the allow-list.
2429.2 · MOD 000523 · Levels 1–3
Are firewall rules managed, approved and documented by an authorised, competent person?
Each inbound rule should have a recorded approval and a stated business reason. This checks that changes go through an authorised person rather than being added freely. An assessor will usually want the rule change process, sample change requests (approved and rejected) and the current rule set.
2430.1 · MOD 000250 · Levels 2–3
Do you remove or disable firewall allow rules once they are no longer needed or have no business purpose?
Rules that outlive their purpose leave openings nobody is watching. This checks that unneeded rules are taken out promptly. Evidence is usually your firewall management policy, plus records or logs of past rule removals.
2430.2 · MOD 000524 · Levels 2–3
Do you review and verify your firewall rules at least annually?
A periodic review catches rules that were missed when they stopped being needed. This checks one happens at least once a year. An assessor will usually want a review report or meeting minutes showing when it last took place.
B5 Resilient networks and systems 0/28 ▼
2500.1 · MOD 000452 · Levels 0–3
Have you worked out how resilient your systems need to be against cyber-attacks and system failures?
This checks that you have judged, rather than assumed, how well your key systems must hold up and recover. An assessor will want to see the risks you identified and which systems are essential, scaled to your size: a short risk note for a small business, a risk register and supporting documents for a larger one.
2500.2 · MOD 000453 · Levels 0–3
Have you put resilience measures into your systems that meet the needs you identified?
This checks that your resilience assessment led to real changes, not just a policy. Expect to show practical measures, such as redundancy, failover, spare capacity or recovery tooling, and explain how each one answers a need from your assessment.
2501.1 · MOD 000525 · Levels 1–3
Are the networks and information systems behind your functions and data protection designed to withstand the incidents and failures you have identified?
This looks at whether resilience is part of the design rather than added later. Network diagrams, security policy and disaster recovery or business continuity plans are the usual evidence.
2501.2 · MOD 000526 · Levels 1–3
When designing for resilience, do you take account of how far systems need to be separated from each other?
Separating systems limits how far a failure or attack can spread. An assessor will usually look at network diagrams and design or policy documents showing where and why systems are segregated.
2501.3 · MOD 000527 · Levels 1–3
Do your resilient designs allow for the resources your systems need to keep running?
This checks that capacity limits, such as storage, bandwidth, processing or power, have been considered so systems do not fail when demand or conditions change. Design documents, diagrams and continuity plans are typical evidence.
2502.1 · MOD 000528 · Level 1
Have you drawn up recovery plans for every system, so you can recover from cyber-attacks and system failures?
This is the Level 1 recovery planning check: the focus is on having plans for all relevant systems. Be ready to show the written plans and talk an assessor through how a recovery would actually work.
2503.1 · MOD 000529 · Levels 2–3
Have you drawn up recovery plans for every system to support recovery from cyber-attacks and system failures?
This is the Level 2–3 version, where the plans are expected to be complete and backed by testing (see the following questions). An assessor will want the documented plans and may ask you to explain how recovery would run.
2503.2 · MOD 000530 · Levels 2–3
Do you test your recovery plans at least annually?
A plan that has never been exercised may not work when needed. Expect to show dated test records, such as results, reports or related communications, proving the plan was put into practice within the last year.
2503.3 · MOD 000258 · Levels 2–3
When recovery plan testing turns up problems, do you log them, assess their risk and fix them within timescales you have defined?
This checks that testing leads to improvement. An assessor may ask for a real example showing the problem recorded, its risk assessed, the fix completed within your defined timescale, and the plan updated where needed.
2504.1 · MOD 000531 · Level 1
Do you keep backups of data that are secure yet available when needed, so you can restore your functions and protect data?
This is the Level 1 backup check. An assessor will usually want your backup approach written down and proof it is working, such as recent backup logs or screenshots.
2504.2 · MOD 000532 · Level 1
Are your backups encrypted with suitable technology so unauthorised people cannot read or alter them?
Backups hold the same sensitive data as live systems, so they need the same protection. Be ready to show the encryption method used and the settings or policy that apply it to your backups.
2504.3 · MOD 000533 · Level 1
Do you check the integrity of your backups to confirm they completed without errors and can be accessed?
A backup is only useful if it is complete and readable. Evidence might include validation logs or reports, a description of how checks are done, or records of successful test restores.
2505.1 · MOD 000534 · Levels 2–3
Do you keep backups of data that are secure yet available when needed, so you can restore your functions and protect data?
This is the Level 2–3 version of the backup check, which the following questions build on. An assessor will usually ask for your backup policy and procedures and may want to see the backup schedule.
2505.2 · MOD 000535 · Levels 2–3
Are your backups encrypted with suitable technology so unauthorised people cannot read or alter them?
At this level, expect to show the encryption standard written into your policies as well as proof it is applied to backups, such as configuration screenshots or logs.
2505.3 · MOD 000536 · Levels 2–3
Do you check the integrity of your backups to confirm they completed without errors and can be accessed?
This checks that backup failures or corruption are caught. An assessor will want results from integrity checks and a description of the process or tools used.
2505.4 · MOD 000537 · Levels 2–3
Where needed, are your backups kept securely off site to support recovery and meet your availability requirements?
Offsite copies protect you if your main site is lost or compromised. Evidence could be a contract with a storage provider or records showing where backups are held off site.
2505.5 · MOD 000265 · Levels 2–3
Do you regularly test restoring from backup to confirm systems and services can be brought back after an incident?
Restoring is the real test of a backup. Expect to show results or reports from recovery tests and a description of how those tests are run.
2505.6 · MOD 000538 · Levels 2–3
For critical systems, do you test recovering from backup at least every 6 months?
Critical systems need more frequent proof that they can be restored. An assessor will want a test schedule showing at least six-monthly testing and reports or logs from the latest tests.
2506.1 · MOD 000539 · Levels 2–3
When backup media is physically moved outside secure locations, which of these do you require?
  • Locked, secured container before it leaves
  • A certified courier to carry it
  • A complete chain of custody record
  • Tracking details recorded for each item
  • Suitable encryption protecting the contents
Media in transit can be lost or stolen, so each safeguard reduces a different risk. Evidence is usually a data transport or similar policy setting out the rules for staff and third parties, plus any courier contract or service agreement and custody or tracking records.
2507.1 · MOD 000272 · Levels 1–3
Do your firewalls block every connection path and service by default unless your Change Advisory Board (CAB), or equivalent approval route, has explicitly authorised it?
Deny-by-default means only approved traffic gets through. Not every organisation has a formal CAB, but some approval mechanism for firewall changes is expected. Be ready to show the policy, how exceptions are approved and a screenshot of firewall rules ending in a default deny.
2507.2 · MOD 000540 · Levels 1–3
Do you regularly review the connection paths and services you have allowed, and remove any that no longer have a business need?
Old firewall exceptions tend to pile up and widen your exposure. An assessor may ask for the review process and records from a recent review showing unneeded rules were taken out.
2508.1 · MOD 000541 · Levels 1–3
Are systems and networks that the public can reach separated, physically or logically, from your internal systems and networks through network segmentation?
If a public-facing system such as a website is compromised, segmentation stops the attacker reaching internal systems. A network architecture diagram and firewall or VLAN configuration showing the separation are typical evidence.
2509.1 · MOD 000276 · Levels 1–3
Do you use tools or methods that detect, block and report malicious or spam email coming into the organisation?
Email is a common route for phishing and malware. Evidence could include filtering tool configuration screenshots, a documented policy, or reports showing recent emails caught and blocked.
2510.1 · MOD 000542 · Levels 1–3
Before any media carrying diagnostic or test programs is used, do you check all of it for malicious code?
USB drives, discs or external drives with diagnostic software can bring malware onto your network. An assessor will want to see the scanning requirement in policy, how scans are carried out, and how you would respond if something malicious were found.
2511.1 · MOD 000543 · Levels 1–3
Do maintenance staff use only tools, techniques and mechanisms that your organisation has approved or supplied?
This limits the risk of unsafe or unknown tools being introduced during maintenance. Evidence might be a policy stating the rule, or a list or inventory of approved maintenance tools.
2512.1 · MOD 000282 · Levels 1–3
When a maintenance session has to be carried out remotely, do you require multi-factor authentication (MFA) to confirm the person's identity before they get access?
Remote maintenance access is a valuable target for attackers. Be ready to show a policy requiring MFA for this access and screenshots of the MFA settings on the remote access route.
2512.2 · MOD 000544 · Levels 1–3
Do you make sure all remote maintenance sessions are closed once the work is finished?
A session left open after maintenance is an unnecessary way in. Evidence could be a policy stating the requirement, logs of recent session closures, or timeout and termination settings.
2513.1 · MOD 000284 · Levels 1–3
Are maintenance workers who lack the required physical access rights supervised by staff who are authorised, qualified and experienced?
This stops visiting maintenance workers reaching sensitive areas or systems unchecked. Expect to show a policy or procedure requiring escorts, and possibly visitor or supervision records.
B6 Staff awareness 0/13 ▼
2600.1 · MOD 000545 · Levels 1–3
Do you run a programme of cyber security training and awareness that gives staff the knowledge, skills and awareness their roles need?
This checks that people are equipped to spot risks and follow security policy. Typical evidence includes the training policy, training records and phishing test results.
2601.1 · MOD 000286 · Levels 2–3
Do your leaders actively promote and encourage good cyber security behaviour, habits and compliance with security policies and procedures?
Culture is shaped from the top. An assessor may look for leadership messages, such as emails, newsletters or presentations, and any schemes that recognise or reward secure behaviour.
2602.1 · MOD 000287 · Levels 2–3
Do you give staff clear, easy-to-find guidance on how to spot and report a security breach?
People can only report what they recognise and know how to report. Evidence might include training content, quick reference guides, intranet pages or internal communications on reporting.
2602.2 · MOD 000546 · Levels 2–3
Are the people who support your functions and the protection of data suitably trained in cyber security?
This focuses on staff whose roles directly affect your key functions and data. Be ready to show training records such as attendance lists, certificates or platform reports, and any policy requiring the training.
2602.3 · MOD 000547 · Levels 2–3
Do staff receive cyber security awareness training when they start and at least annually after that?
This checks both onboarding and refresher training. An assessor will want records for new starters and for annual training across staff, such as completion reports or certificates.
2602.4 · MOD 000548 · Levels 2–3
Which of these does your awareness training prepare relevant staff to recognise and respond to?
  • Social engineering and phishing
  • Advanced persistent threats
  • Suspected breaches
  • Suspicious behaviour
This checks the breadth of your training content. An assessor will usually ask for course outlines or materials showing each topic is covered. Organisations handling MOD information should also make sure staff know about reporting incidents to the Defence Industry WARP.
2602.5 · MOD 000549 · Levels 2–3
When do you update your cyber security training, awareness material and communications?
  • At least annually
  • When the threat changes significantly
Training goes stale as threats move on. Evidence could be version histories of training material, minutes from review meetings, or notes of changes prompted by emerging threats.
2603.1 · MOD 000550 · Levels 1–3
How often do you revisit and refresh the security risks that users, administrators and managers of your systems need to know about?
  • At least annually
  • When the organisation changes significantly
  • When the threat changes significantly
This checks that people's awareness of risk stays current. An assessor may ask for review records, updated risk registers or assessments, and the communications that passed the changes on to staff.
2603.2 · MOD 000551 · Levels 1–3
Which of these do you make system users, system administrators and management aware of, where relevant to them?
  • Security risks
  • System security policies
  • System security standards
  • System security procedures
People need to know both the risks and the rules that manage them. Evidence might include training materials, attendance logs, internal communications and copies of the relevant policies or procedures.
2604.1 · MOD 000367 · Levels 1–3
Do you have a formal Acceptable Use Policy?
An acceptable use policy sets out how people may use your systems and information. The assessor will normally ask for a copy.
2604.2 · MOD 000552 · Levels 1–3
Which of these does your Acceptable Use Policy place suitable restrictions on?
  • Social media, networking sites and external sites or apps
  • Posting organisational information on public websites
  • Using work email addresses or passwords to create external accounts
  • Clear desk and clear screen
  • Handling company assets away from the office
  • Where work may be carried out
  • Collaborative devices, including remote activation (e.g. meeting cameras)
This checks how far your policy reaches beyond basic IT use. For each item you select, be ready to point to the section of the policy that covers it. The NCSC and NPSA publish guidance on social media risks that may help.
2605.1 · MOD 000553 · Levels 2–3
Does your cyber security awareness training include practical exercises?
Hands-on exercises, such as phishing simulations or incident drills, show whether training has sunk in. An assessor may want reports from exercises you have run and evidence of how they were planned.
2605.2 · MOD 000638 · Levels 2–3
Which of these apply to your practical cyber security exercises?
  • Based on current threat scenarios for your organisation
  • Completed by staff at least annually
  • Assessed, with feedback to participants and their supervisors
This checks that exercises are relevant, regular and lead to learning. Evidence could include exercise designs tied to current threats, participation records and feedback reports.
B7 Personnel and environment 0/12 ▼
2700.1 · MOD 000554 · Levels 1–3
Do you carry out suitable background checks before employing staff who will have access to data?
Checks before hiring reduce the risk of bringing in someone untrustworthy. Expect to show a policy or procedure requiring the checks, and possibly anonymised records of completed checks. Checks apply unless the law prevents them.
2700.2 · MOD 000297 · Levels 1–3
Which of these form part of your pre-employment background checks?
  • Checking credentials
  • Employment history
  • Qualification checks
  • Applying or verifying BPSS (Baseline Personnel Security Standard)
This checks what your screening actually covers. For each item selected, an assessor will want to see it in your process documents and may ask for anonymised confirmation records.
2701.1 · MOD 000555 · Levels 1–3
Do you have, and follow, a policy setting out when BPSS checks and National Security Vetting (NSV) are applied to staff who support your functions and the protection of data?
NSV is usually only possible once a contract requires it, so this checks that you can and will vet staff when needed. Evidence might be your written vetting process, contracts with a vetting provider, the internal rule that makes vetting mandatory, or anonymised vetting records.
2702.1 · MOD 000556 · Levels 1–3
Do you have a joiners, movers and leavers policy?
This policy keeps access and assets under control as people start, change role and leave. The assessor will normally ask for a copy.
2702.2 · MOD 000557 · Levels 1–3
Which of these do your procedures for new starters make sure happen?
  • Access is granted according to role and responsibilities
  • Suitable cyber security training is completed
  • Understanding of relevant security policies and procedures is checked
This checks that new starters get only the access they need and know the rules from day one. Evidence might be the procedure itself, onboarding checklists or workflows, and training records.
2702.3 · MOD 000558 · Levels 1–3
Which of these do your procedures for staff changing role or department make sure happen?
  • Access rights are reviewed
  • Permissions and data are handed over securely
  • Security training for the new duties or systems is given
Role changes often leave people with access they no longer need. An assessor may ask for the procedure, access review records for staff who have moved, and role-specific training records.
2702.4 · MOD 000559 · Levels 1–3
Which of these do your procedures for leavers make sure happen promptly?
  • Access to systems and data is removed
  • Issued equipment is returned (laptops, tokens, keys, ID passes)
  • Credentials known to the leaver are changed, including shared ones and door codes
Leavers can keep access long after they go if offboarding is slow or incomplete. Evidence could include the procedure, records of access removal and equipment recovery for recent leavers, and records of credential or door code changes.
2702.5 · MOD 000560 · Levels 1–3
Do you hold exit interviews, or otherwise remind people who are leaving of their data security responsibilities?
Obligations to protect data often continue after someone leaves. An assessor may ask for exit interview templates or records, or the communication and procedure you use to cover this during offboarding.
2703.1 · MOD 000628 · Levels 1–3
How do you encourage staff to report suspicious activity or breaches of cyber security policy?
  • A reporting route that carries no fear of punishment
  • Training for staff on how to report
People will only speak up if they know how and feel safe doing so. Evidence might include documented reporting processes, training records and awareness material such as posters or announcements.
2703.2 · MOD 000561 · Levels 1–3
Do you have a disciplinary process for investigating and acting on suspected breaches of security policies or procedures by staff?
This makes clear that security rules are enforced. The assessor will normally ask for a copy of the process.
2704.1 · MOD 000626 · Levels 1–3
Which of these environmental controls have you assessed your need for?
  • Fire suppression
  • Temperature and humidity control (e.g. in data centres)
  • Backup power
Not every organisation needs every control, but the need must be considered. An assessor may ask for risk assessments, meeting notes or policies showing how you decided what your premises and equipment require.
2704.2 · MOD 000641 · Levels 1–3
Have you installed and do you maintain the environmental controls you judged to be appropriate?
This checks that your assessment led to action. Expect to show maintenance logs or service records for the controls in place, which the assessor may compare with your answer to the previous question.
C1 Security monitoring 0/38 ▼
3100.1 · MOD 000562 · Levels 1–3
Do you keep watch over the security state of the networks and systems that run your business functions and hold your data?
This checks that you have ongoing visibility of how secure your core networks and systems are. An assessor will usually want to see the monitoring tools or methods you use, which systems they cover, and example dashboards or reports.
3100.2 · MOD 000563 · Levels 1–3
Is your security monitoring used to spot possible security problems?
Monitoring only helps if it actually surfaces issues. Be ready to show examples of problems your monitoring has raised, such as alerts or reports, and how they reached the right people.
3100.3 · MOD 000564 · Levels 1–3
Do you use your monitoring to check whether your protective security measures are still working?
This looks at whether monitoring tells you if controls such as firewalls, anti-malware or access controls keep doing their job. An assessor may ask for reports or reviews showing how you track that over time.
3101.1 · MOD 000565 · Levels 1–2
Do you have written policies, procedures and controls for monitoring security events?
This checks that event monitoring follows a defined, documented approach rather than being informal. Expect to show the relevant policy or procedure document and who owns it.
3101.2 · MOD 000566 · Levels 1–2
Which of these does your security event monitoring procedure cover?
  • Which security events are monitored
  • How often monitoring takes place
  • Named roles and responsibilities
  • An escalation path for events
Your procedure should make clear what is watched, how often, who does it and where issues go next. An assessor will usually read the procedure itself to confirm each of these is addressed.
3101.3 · MOD 000567 · Levels 1–2
Is security event monitoring carried out the way your procedures say it should be?
A written procedure is only useful if people follow it. Be ready to show records, logs or tickets that demonstrate monitoring happening as documented.
3101.4 · MOD 000316 · Levels 1–2
Do you raise alerts when a possible security event is detected?
This checks that monitoring produces alerts rather than relying on someone happening to notice. An assessor may want to see how alerts are configured and examples of alerts raised.
3102.1 · MOD 000568 · Level 3
Do you have written and implemented policies, procedures and controls for continuous security event monitoring?
At Level 3 monitoring must be continuous and formally documented, and the documents must reflect what actually happens. Expect to show the procedure and evidence that it is in operation.
3102.2 · MOD 000571 · Level 3
Does your security event monitoring cover every identified system in both production and non-production environments, and how do you confirm that coverage is complete and working?
Test, development and staging systems can be attacked too, so they need monitoring as well as live systems. Be ready to show a list of identified systems, how you check each one is feeding into monitoring, and how you would notice if one stopped.
3102.3 · MOD 000569 · Level 3
Which of these does your security event monitoring procedure cover?
  • Which security events are monitored
  • How often monitoring takes place
  • Named roles and responsibilities
  • An escalation path for events
  • Tools used for 24x7x365 monitoring and correlation
At Level 3 the procedure also needs to name the tools that provide round-the-clock monitoring and correlation. An assessor will usually check the documented procedure for each element.
3102.4 · MOD 000570 · Level 3
Are all of your identified systems monitored for security events 24x7x365?
This checks that monitoring never stops, including nights, weekends and holidays, whether in-house or through a provider. Expect to show rotas, service agreements or tooling that proves continuous coverage.
3102.5 · MOD 000320 · Level 3
Do you raise alerts when a possible security event is detected?
Continuous monitoring should generate alerts that someone acts on at any hour. An assessor may ask to see alert rules and examples of alerts and how they were handled.
3103.1 · MOD 000572 · Levels 2–3
Do you have written policies, procedures and controls for keeping logging data secure?
This checks that protecting logs is a defined part of how you work. Expect to show the relevant policy or procedure covering how logs are stored and protected.
3103.2 · MOD 000573 · Levels 2–3
Is read-only access to logs given only to authorised people who need it for their job?
Logs can hold sensitive information and are valuable to attackers, so access should be limited. Be ready to show who has access to log data and how that access is approved.
3103.3 · MOD 000324 · Levels 2–3
Are your audit tools protected against unauthorised access, changes and deletion?
If someone can tamper with audit tools they can hide their tracks. An assessor may look at access controls and permissions on your logging and audit tooling.
3103.4 · MOD 000574 · Levels 2–3
Which of these do you require and enforce for stored logs?
  • A documented retention period
  • Protection from deletion until that period ends
  • Deletion once the retention period has passed
Logs should be kept long enough to be useful, protected while kept, and removed when no longer needed. Expect to show the documented retention period and the settings or processes that enforce it.
3104.1 · MOD 000627 · Levels 2–3
Which of these are part of how you triage security events?
  • Reviewing alerts generated from security events
  • Checking that identified and triggered alerts are reliable
  • Using monitoring tools to find evidence of security incidents
Triage is about deciding which alerts are genuine and need action, and making sure alerts can be trusted. An assessor may ask to see examples from your monitoring tool and how you tune alerts to cut false positives without missing real events.
3105.1 · MOD 000575 · Levels 2–3
Do you have documented plans and procedures for identifying security incidents?
This checks there is a defined way of deciding when an alert or event becomes an incident. Expect to show the relevant procedure or plan.
3105.2 · MOD 000576 · Levels 2–3
When identifying security incidents, do you put alerts in context using what you know about current threats and your own systems?
An alert means more when you know what threats are active and how your systems are set up. Be ready to explain the threat information you use and how analysts apply it when assessing alerts.
3105.3 · MOD 000577 · Levels 2–3
Do you bring in your incident response capability as soon as an incident is found, whether or not it has been confirmed?
Waiting for certainty can let an incident grow. An assessor may ask to see the trigger points for involving incident response and records showing it happening.
3106.1 · MOD 000578 · Levels 2–3
Do your security monitoring staff have the skills, tools and assigned roles needed for your:
  • Governance requirements
  • Reporting requirements
  • Expected threats
  • Network and system complexity
Monitoring staff, whether employed or outsourced, need to match what your organisation requires of them. Expect to show role descriptions, training or qualifications, the tools they use and, for outsourced monitoring, the relevant contract or service description.
3106.2 · MOD 000579 · Levels 2–3
Do your security monitoring staff understand your business functions and what is needed to protect your data?
Knowing the business helps monitoring staff judge which events matter most. Be ready to show how staff are briefed on the business, for example through induction material or documented service context.
3107.1 · MOD 000580 · Levels 1–3
Do you have written policies and procedures for creating, retaining and correlating audit logs?
This checks there is a documented approach to logging. Expect to show the logging policy or procedure and how it applies to your systems.
3107.2 · MOD 000581 · Levels 1–3
Do all systems that run your business functions or protect your data generate event logs?
Gaps in logging leave blind spots. An assessor may compare your system inventory with your logging configuration to confirm coverage.
3107.3 · MOD 000582 · Levels 1–3
Do you log every key security event type that your policies define?
Your policies should name the event types that matter, such as access to critical files, new user accounts, repeated failed logins or logging failures. Be ready to show that list and the settings that capture it.
3107.4 · MOD 000583 · Levels 1–3
Do you check at least every 6 months that the event types you log still meet business requirements?
Needs change as systems and threats change, so the logged event types should be revisited. Expect to show records of these reviews and any changes made.
3107.5 · MOD 000584 · Levels 1–3
Which of these do your system event logs record?
  • Date and time taken from an NTP source
  • User ID
  • Device accessed
  • Network port used
Consistent log content makes it possible to trace what happened, who did it and where. An assessor will usually look at sample log entries and your time synchronisation settings.
3107.6 · MOD 000585 · Levels 1–3
Can logs be made available for analysis when requested?
Logs are only useful if they can be retrieved when needed, for example during an investigation. Be ready to demonstrate retrieving logs for a given system and period.
3107.7 · MOD 000586 · Levels 1–3
Are system logs reviewed at least weekly to find failures, faults and possible security issues?
Regular review catches problems before they grow. Expect to show evidence of weekly reviews and the follow-up actions taken.
3107.8 · MOD 000587 · Levels 1–3
Are logs archived for at least 12 months?
A year of history supports investigations into incidents discovered late. An assessor may check retention settings or look for logs that are close to 12 months old.
3107.9 · MOD 000588 · Levels 1–3
Is the ability to modify system logs restricted so they can't be tampered with?
Logs need to be trustworthy evidence. Be ready to show who can change or delete logs and how that permission is controlled.
3107.10 · MOD 000589 · Levels 1–3
Are audit records kept on a physically separate system from the systems being audited?
If audit records sit on the same system, compromising or losing that system can take the records with it. Expect to show where audit records are stored and how that storage is kept separate, including for cloud services.
3107.11 · MOD 000590 · Levels 1–3
Do you monitor whether your logging and auditing systems are working and alert when they fail?
A silent logging failure can leave you without evidence when you need it. An assessor may ask to see health monitoring for logging systems and examples of failure alerts.
3107.12 · MOD 000591 · Levels 1–3
Do you have an effective way to filter audit records and produce reports from them?
Large volumes of logs need to be reduced to what matters before they are useful. Be ready to show the tool or process you use and example reports.
3108.1 · MOD 000592 · Levels 1–3
Does that capability meet your needs for reviewing, analysing and reporting on audit records on demand?
You should be able to pull and analyse audit records whenever needed, including after an incident. An assessor may ask for a demonstration of an on-demand search or report.
3108.2 · MOD 000593 · Levels 1–3
When you use that capability, do the original audit records keep their content and time order unchanged?
Filtering and reporting must not alter the underlying records, or they lose value as evidence. Expect to explain how the tool works on copies or views rather than changing the source records.
3109.1 · MOD 000594 · Levels 1–3
Are your audit record review, triage, analysis and reporting linked into your governance and incident management arrangements?
Findings from logs need to reach the people who manage risk and incidents, not stop with the monitoring team. Be ready to show how log findings are escalated and reported to management and into incident handling.
3110.1 · MOD 000595 · Levels 2–3
Do you watch for published security alerts and advisories relevant to your systems and take action on them?
Vendor notices and threat advisories often need a response such as patching or reconfiguration. Expect to show the sources you follow, how relevant advisories are identified and records of the action taken.
C2 Proactive detection 0/8 ▼
3200.1 · MOD 000629 · Levels 1–3
Do you have procedures to actively look for malicious activity in your networks and systems, including activity that signature-based prevention and detection tools would miss?
Signature-based tools only catch known threats, so new or targeted attacks need other methods such as behaviour analysis or threat hunting. Be ready to describe the methods you use and show examples of their output.
3201.1 · MOD 000597 · Levels 1–3
Have you defined examples of abnormal system behaviour to help catch malicious activity that is otherwise hard to spot?
Knowing what unusual looks like on your systems makes subtle attacks easier to notice. Expect to show your documented examples and how they are used in monitoring.
3202.1 · MOD 000598 · Levels 2–3
Do you actively detect malicious activity by joining up your event detection, threat monitoring and incident response?
Detection works best when these capabilities share information and feed each other. An assessor may ask how the three connect in practice and for an example where they worked together.
3202.2 · MOD 000342 · Levels 2–3
Do you use threat intelligence to adjust and improve what your monitoring and attack detection cover?
Threats change, so detection should change with them. Be ready to show the threat intelligence sources you use and examples of monitoring or detection rules updated as a result.
3203.1 · MOD 000599 · Levels 1–3
Do you actively search your systems and technologies for known indicators of compromise to support detection?
Searching for known signs of compromise can find attacks that alerts missed. Expect to show how searches are run and records of recent searches.
3203.2 · MOD 000600 · Levels 1–3
Do you follow alerts and advisories from sources you trust in order to pick up new indicators of compromise?
New indicators are published all the time and should be picked up quickly. An assessor may ask which sources you follow and how new indicators are added to your detection.
3204.1 · MOD 000601 · Levels 1–3
Do you use tools to find unauthorised hardware, software and firmware in your systems?
Unapproved components can introduce risk or signal a compromise. Be ready to show the tools used and example detection results.
3204.2 · MOD 000602 · Levels 1–3
When unauthorised components are found, which of these actions do you require, where appropriate and proportionate?
  • Cutting off the component's network access
  • Isolating the component
  • Telling system administrators and/or the security operations team
Finding an unauthorised component is only useful if something happens next. Expect to show the documented response steps and records of them being followed.
D1 Incident response 0/16 ▼
4100.1 · MOD 000603 · Levels 1–3
Do you have clearly defined policies and processes for managing cyber security incidents?
This checks that incident management is defined before it is needed. Expect to show the policy and process documents; keeping a paper copy is recommended in case systems are unavailable during an incident.
4100.2 · MOD 000604 · Levels 1–3
Have you tested your cyber security incident management processes?
Untested processes often fail under pressure. Be ready to show records of tests or exercises and what was learned from them.
4101.1 · MOD 000605 · Levels 2–3
Do you have a cyber security incident response plan?
This checks that a response plan exists. Expect to show the plan itself and to explain where copies are kept, including an offline or paper copy.
4101.2 · MOD 000606 · Levels 2–3
Which of these describe your cyber security incident response plan?
  • Based on risk assessments
  • Kept current and maintained
  • Covers a range of possible incident scenarios
  • Has been tested
A useful plan reflects your actual risks, stays current and works for different kinds of incident. An assessor will usually review the plan, its version history and any test records.
4101.3 · MOD 000607 · Levels 2–3
Are there set procedures for incident response staff to follow at each stage of your response plan?
Clear step-by-step procedures help people act quickly and consistently. Expect to show the procedures or playbooks linked to each stage of the plan.
4101.4 · MOD 000608 · Levels 2–3
Is your incident response plan reviewed at least once a year?
Regular review keeps the plan in step with changes to systems, staff and threats. Be ready to show review dates and records of changes.
4102.1 · MOD 000609 · Levels 2–3
Has senior leadership endorsed your incident response plan so it can be carried out with the right authority during an incident?
Responders need the authority to make disruptive decisions quickly. Expect to show sign-off by senior leadership and how their authority is reflected in the plan.
4102.2 · MOD 000351 · Levels 2–3
During an incident, do you have processes that give responders the information they need to make decisions and coordinate with contingency plans?
Good decisions depend on having the right information, such as asset lists, contacts and contingency arrangements, when systems may be down. Be ready to explain how responders get that information and how response links to continuity plans.
4103.1 · MOD 000610 · Levels 2–3
Do you run exercises at least once a year to test your cyber security incident response plans?
Exercises show whether plans work in practice. Expect to show dates, scenarios and outcomes of recent exercises.
4103.2 · MOD 000611 · Levels 2–3
Which of these do you base your incident response exercises on?
  • Past incidents relevant to your organisation
  • Threat intelligence
  • Risk assessments
Realistic exercises draw on what has happened before, what threats are active and what your risks are. An assessor may look at exercise scenarios and how they were chosen.
4104.1 · MOD 000612 · Levels 1–3
Is your incident handling capability strong and complete enough to deliver your incident management policy and response plans?
This checks that you can actually do what your policy and plans describe, across the whole organisation. Be ready to show the people, tools and arrangements in place and evidence of them being used.
4104.2 · MOD 000613 · Levels 1–3
Which of these does your incident handling capability include?
  • Preparing for incidents
  • Detecting incidents
  • Forensic analysis of incidents
  • Containing incidents
  • Recovering from incidents
  • Communicating with users
  • Tracking incidents
  • Documenting incidents
  • Reporting incidents to relevant officials and/or authorities
A full capability covers the whole life of an incident. Expect to show procedures and records for each stage; if you handle MOD information, be aware of any contractual or regulatory reporting duties.
4105.1 · MOD 000355 · Levels 2–3
Do you test at least once a year whether data can be exfiltrated through your network boundaries?
Exfiltration testing shows whether data could be taken out of your organisation without being stopped or noticed. Expect to show test reports and dates.
4105.2 · MOD 000614 · Levels 2–3
Do your boundary exfiltration tests cover both authorised and covert channels?
Attackers may abuse permitted routes such as email or DNS as well as hidden channels. Be ready to show which channels were tested and the results.
4105.3 · MOD 000615 · Levels 2–3
Are your boundary exfiltration tests used to test and train your incident response procedures?
Using these tests as practice helps responders recognise and react to data theft. Expect to show how the tests were linked to response procedures or training.
4106.1 · MOD 000356 · Levels 1–3
Do you identify and review which internal users were behind communications that were denied?
Blocked outbound or internal connections can be a sign of misuse or compromise. An assessor may ask how you trace denied connections to users and what follow-up you do.
D2 Recovery and improvement 0/7 ▼
4200.1 · MOD 000616 · Levels 1–3
Do you have procedures for carrying out root cause analysis after incidents?
Understanding why an incident happened helps prevent a repeat. Expect to show the procedure and examples of completed analyses.
4200.2 · MOD 000617 · Levels 1–3
Do you feed lessons learned from incidents into updated response procedures, training, testing and other relevant documents, and put those changes into practice?
This checks that incidents lead to real improvement, with changes made promptly after the analysis. Be ready to show lessons-learned records and the documents, training or tests updated as a result.
4201.1 · MOD 000619 · Levels 2–3
Do you carry out business continuity risk assessments?
These assessments identify what could interrupt the business and how badly. Expect to show recent assessments and who carried them out.
4201.2 · MOD 000620 · Levels 2–3
Which of these do your business continuity risk assessments cover?
  • Threats
  • Impact of a service outage or breach
  • Likelihood of a service outage or breach
  • Risks
  • Whether current recovery plans are adequate
A thorough assessment looks at what could happen, how likely it is, how much it would hurt and whether you could recover. An assessor will usually read the assessment to check each area is covered.
4201.3 · MOD 000621 · Levels 2–3
Are business continuity risks entered in a risk register, with the improvements needed to reduce them tracked?
Recording risks alongside the actions to address them makes sure they are followed through. Expect to show the risk register entries and progress on the mitigating actions.
4202.1 · MOD 000623 · Level 3
Have you assessed whether you need backup networking and telecoms systems to protect your business functions and data?
Backup links or systems keep the business running if main networks or phone lines fail. Be ready to show the assessment and the reasoning behind its conclusions.
4202.2 · MOD 000624 · Level 3
Where needed, have you put backup networking and telecoms systems in place?
If the assessment finds a need, the backup systems must actually exist and be protected. Expect to show the systems in place, such as secondary connections or failover arrangements.