Could your agency show its cybersecurity program today?

A checklist for local governments, school districts and public agencies, built around what state law, auditors and the CJIS Security Policy now ask for. About ten minutes, no form to fill in.

By continuing, you agree to our cookie policy.

See all 16 questions

Program and ownership

  1. Do you have a written cybersecurity program?
  2. Is one named person responsible for it?
  3. Has your governing body been briefed on it in the last 12 months?
  4. Do staff complete security training every year?
  5. Do you have a list of vendors and service providers that can reach your systems or data?

Access and MFA

  1. Is multi-factor authentication on for every account, including email and remote access?
  2. Does everyone have their own login?
  3. Is access removed the same day someone leaves?
  4. Are admin rights limited to the people who need them?

Payments

  1. Is every change to a vendor's bank details confirmed by phone before it's used?
  2. Does it take two people to send a payment?
  3. Are staff trained to recognize fake invoices and payment change requests?

Incident response and recovery

  1. Do you have a written incident response plan that has been tested?
  2. Do you know your incident reporting deadlines?
  3. Has your governing body agreed how a ransom demand would be decided?
  4. Do you have backups an attacker couldn't reach or delete, and have you tested restoring them?