Governance & Risk
Policy, risk management, accountability and supplier assurance.
Answer as things really are — there are no wrong answers, and your result is only as useful as it is honest.
Do you have documented, approved information security policies that are reviewed on a regular cycle?
Do you maintain a security risk register where risks are assessed, treated and reviewed?
Are security roles and responsibilities (e.g. a security lead / CISO) formally assigned?
Do you assess the security of third-party suppliers and cloud services before and during use?
Do you maintain an up-to-date inventory of information assets together with their classification?
If you build or customise software, is a secure development lifecycle applied (code review, dependency/SCA scanning, secrets management, separated environments)?
Do you govern staff use of public AI tools and unsanctioned SaaS (shadow IT), with guidance on what data may be shared?