This section assesses how permissions are assigned throughout the organisation. It includes questions such as:

• How are permissions managed throughout the environment?
• Are permissions provisioned on a principle of least privilege?
• Are administrative functions restricted?
• Do cloud environments have segregated groups?
• Is MFA enforced for all cloud services?

This section assesses how updates are applied throughout the organisation. It includes questions such as:

• Are updates automatically applied where possible?
• How are devices kept up to date and licensed?
• Are legacy systems securely segmented from the live environment?
• Are all high and critical vulnerabilities patched within 14 days?

This section assesses how devices are protected from malware throughout the organisation. It includes questions such as:

• What anti-malware solutions are in place?
• How are anti-malware solutions kept up to date and licensed?
• Are there malware controls on email and web downloads?
• Are malware signatures applied within 24 hours?
• Are all devices protected?

This section assesses how devices are hardened and protected from attackers. It includes questions such as:

• Are devices built to certain cyber security standards?
• Are users restricted on what they can download and execute?
• Are devices configured with firewalls enabled?
• Are devices centrally managed?
• How are security policies pushed to devices?

This section assesses how the network has been hardened and protected from attackers. It includes questions such as:

• Are firewall rules in place to segment networks?
• Are services exposed to the public internet?
• Are cloud services and login forms restricted to certain addresses?
• Are networking devices kept up to date and in support?
• Have default credentials on networking devices been changed?