Cybersecurity Assessment Questionnaire
Section 1: Organization Information
1. Organization Name:
____________________________________________________
2. Contact Information:
Who should we contact for follow-up questions?
Name: _____________________________________________
Email: _______________________________________________
Phone number: _____________________________________
3. Assessment Purpose:
To identify major cybersecurity gaps related to critical assets and recommend
solutions, develop policies, procedures, and standards to address these gaps and
enhance cybersecurity.
Section 2: Asset Identification
4. Asset Inventory:
Can you provide a list of all hardware assets (servers, workstations, network
devices) used within your organization?
o (Follow-up: What operating systems do these assets use?)
5. Software Assets:
What software applications are currently in use? Please specify version and
licensing information for each application.
6. Data Sensitivity:
What types of data do you store and process? (e.g., personal information,
financial data, intellectual property)
7. Third-Party Assets:
Do you utilize any third-party services or cloud solutions? If so, please list them
and indicate the type of data processed.
Section 4: Network Security Measures
11. Current Network Security Measures:
What cybersecurity measures are currently in place? (e.g., firewalls, IPS & IDS)
Are there any firewalls in place between internal networks and external-facing
systems?
Section 5: Endpoint Security Measures
12. Current Endpoint Security Measures
Do you have antivirus/antimalware protection on all endpoints (servers,
desktops, mobile devices)?
o (Follow-up: What endpoint detection and response (EDR) solutions do
you have in place for real-time threat detection?)
Section 6: Application Security Measures
13. Current Application Security Measures
Do you have web application?
o (Follow-up: How do you secure and monitor web application security?)
Do you conduct security assessments of third-party services before integrating
them into your systems?
Section 7: Data protection and Privacy Measures
14. Current Data protection and Privacy Measures
Do you have sensitive data?
o (Follow-up: How do you protect your sensitive data?)
Section 8: Physical security
15. Integration of Cyber and Physical Security
Do you have physical access controls to protect critical assets (e.g., surveillance
cameras, access control systems, alarm systems)
How are physical access controls implemented to protect critical infrastructure,
such as data centers, server rooms, and network equipment, from unauthorized
access or tampering?
Section 9: Governance, Risk, and Compliance (GRC)
16. Enterprise GRC
Do you have an enterprise-wide cybersecurity policy and procedure?
o (Follow-up: If yes, what are they? And is it regularly updated?)
Are there any frameworks that your organization has to meet (e.g., NIST, ISO
27001, CIS)?
Section 10: Training and Awareness
17. Employee Training and security culture
Do you conduct regular cybersecurity awareness training for all employees?
Are there specific training programs for IT and security personnel?
