Who should conduct a Cybersecurity Self-Assessment?

Almost everyone in your organization.

We understand this may sound crazy, but your cybersecurity stance isn’t just about computers, applications and IT. It also involves privacy policies, terms and conditions, marketing outreach and anything that gathers or maintains data about your company, customers and employees. If you’re in a position that involves data, you’re involved in cybersecurity.

Trust us, this isn’t techy or scary. The more involved you are in maintaining your security stance, the more your cybersecurity team can do to maintain a safer security environment.

Let’s say you have an existing role or even a new role within a company that involves data, you should be asking basic security discovery questions. Depending on your role, you will look at different things. Marketing will want to review privacy policies, terms and conditions, customer databases and any other digital assets that pertain to their job. Executives may be more interested in company IP and financial information and whether there is enough protection to keep that data safe from competitors or external threats. If you are on the technical side, you are going to evaluate the technology, applications and architecture in the company.

It might be obvious that a self-assessment is better done as a team, evaluating every question from multiple angles, including managerial, legal, accounting, marketing, sales and operational perspectives. By doing that, you can determine how prepared you are to prevent potential breaches, cybersecurity threats or compliance issues across the entire company.

Regardless of your role, it’s important to note that unless your company is highly prepared with full documentation, a professional services company won’t be able to help you out initially. It would help if you understood what basic cybersecurity procedures are in place before you spend money on experts who will only be asking the same initial questions.

Understanding your digital assets is the first place to start. In other words, digital assets are any data that brings value to the company. For instance, core data relating to the transactional information involving the customer, your intellectual property, financial records, employee data and anything pertaining to the operations of the company. A self-assessment is really about understanding the status of these digital assets.

Let’s start with some easy questions:

• Do you know what are the digital assets in your company?
• Do you know how these digital assets are used and by whom?
• Does your company have clear objectives and protocols relating to your digital assets?
• Do you know what digital assets your company maintains and where they are located?
• Do you know who has access to your digital assets?
• Do you know the specific people and departments responsible for maintaining those assets?
• Are your digital assets properly secured and managed?
• Are you complying with all industry standards, regulations and requirements?
• Are your digital assets accessible to any parties outside of your company? If so, how are they protected?
• Do you have policies and procedures that protect your customers and your employees in places, such as privacy policies, terms of use or compliance requirements?
• What technology and applications are you using to secure your digital assets?

When you understand the state of your digital assets, as well as the processes and procedures that surround them, you are able to understand how those assets are protected and what changes you need to bring forward to better protect those assets and your company. The result is more robust policies, stronger networks, better compliance, and a more defensible cybersecurity stance.

About Parabellyx

Parabellyx are security-matter-experts who take a focused and business aligned cybersecurity approach to developing strategies that accomplish your key business goals and objectives. We then train your entire organization in security, preparing you for any threat, until a security mindset is entrenched across your entire company, protecting and ‘future-proofing’ your information, your employees, your customers, your shareholders and your reputation. Contact us