How many employees does your organization have?





What sector does your organization primarily operate in?



How would you describe the level of cybersecurity maturity within your organization?








Does your organization utilize a formally recognized cybersecurity management framework? Please select all that apply.








When was the current cybersecurity management framework implemented? Please select the closest date range.


How are cybersecurity responsibilities distributed across different departments/roles in your organization?


Does your organization identify primary internal and external cybersecurity stakeholders (e.g., personnel, shareholders, customers, government)?


Describe how the top management demonstrates its commitment to cybersecurity governance. Please select all that apply.

How frequently is cybersecurity training provided to employees, and what does it entail? Please select the closest option.


How is the effectiveness of the cybersecurity culture evaluated in your organization? Please select all that apply.








Does the Cyber strategy have buy-in from all the various business units within the organization?



Detail the process your organization follows to identify and prioritize cybersecurity risks. Please select all that apply.








What is your organization’s risk appetite?










Describe the cybersecurity risk assessment frequency. Please select the closest option.



Is there an established cybersecurity risk management plan in your institution?








Does your institute have a document or database on cybersecurity risk experience and treatment methods?




What factors does your organization’s risk strategy primarily consider?











What percentage of your IT budget is dedicated to cybersecurity? Please select the closest option. (Please provide figures for the past fiscal year)




Discuss the availability and adequacy of resources allocated for implementing and maintaining cybersecurity measures. Please select all that apply.









Does your organization have a Governance, Risk and Compliance (GRC) tool?



How do you track cyber breach activities?








Is there an established process for responding to and managing cybersecurity incidents?


Does the institution have directives or instructions for incident reporting to the governmental organizations?




Does the institution have directives or instructions for customer authentication in cyberspace?




Does the institution have directives or instructions for outsourcing processes, products, or services in cyberspace?





How does your organization monitor and evaluate the effectiveness of its cybersecurity measures? Please select all that apply.








How often does the senior management review the cybersecurity strategy? Please select the closest option.




Are there established procedures for ensuring compliance with relevant cybersecurity laws and regulations?




Does your organization have Cyber Insurance?




During vendor selection, do you ensure the selected vendor has cyber insurance?




Do you have a Third-Party Risk Management (TPRM) function in your organization?




How does the organization stay up-to-date of and respond to changes in the cybersecurity regulatory environment? Please select all that apply.