Free self-check · about 3 minutes

Incident readiness self-check

Ten questions on how ready your organisation is to handle a security incident. Written for small and mid-sized organisations and public bodies.

Your answers stay in your browser. Nothing is sent anywhere, and the page uses no cookies or analytics.

01 Is there a named person responsible for handling security incidents, with a deputy and up-to-date contact details everyone can find?
02 Do you keep offline or immutable backups of critical systems, and have you tested a full restore in the last 12 months?
03 Do you have a current inventory of your systems, data and internet-facing services, including who owns each one?
04 Are logs from key systems (identity, email, firewalls, servers) collected in one place and kept long enough to investigate an incident, e.g. 90 days or more?
05 Is multi-factor authentication enforced for all admin accounts, email and remote access such as VPN and remote desktop?
06 Are internet-facing systems (VPN, firewalls, mail, web applications) patched promptly, with critical fixes applied within days?
07 Do you have a written incident response plan that has been exercised, for example in a tabletop session, in the last 12 months?
08 Do you know whom to call externally during an incident — incident response support, cyber insurer, legal counsel, the national CERT/CSIRT, police?
09 Do you know whether the Czech Cyber Security Act / NIS2 applies to you, and what your incident reporting duties and deadlines would be?
10 Do you have security contacts and incident-notification commitments from your key IT suppliers and service providers?

0/10 answered