01 Do you know what your critical services depend on? Think dispatch, records, payments or patient care, plus the systems, providers and people behind them.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
02 Is strong multifactor authentication required for remote and administrator access? Check employee, administrator and vendor accounts. Prefer phishing-resistant methods such as security keys.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
03 Is someone responsible for urgent security updates on internet-facing systems? Include firewalls, remote-access systems and vendor-managed services.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
04 Have you successfully restored a critical system from a protected backup? A successful backup job is not a restore test. Check that an attacker using normal administrator credentials cannot alter every backup.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
05 Does a named person or provider investigate security alerts after hours? Ask who receives the alert, how quickly they respond and who can authorize containment.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
06 Have you practiced the first hour of a cyber incident? Include leadership, IT, communications and key providers. Keep contact details available if email fails.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
07 Can staff use a tested fallback for an essential service? Think paper workflows, alternate communications and the safe return to normal operations.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
08 Are responsibilities clear between your agency and its technology providers? Check who handles security updates, access removal, incident notification and restoration.
Yes, verified We can show current evidence. Partly Some coverage or work remains. Not yet This is not in place. Not sure We need to ask or check.
