The 20 Key Areas Of Focus For A Cyber Security Assessment

1. Network Security

• Perform a network vulnerability scan (internal/external).
• Review firewall configurations and rule sets.
• Check for segmentation of sensitive data and network zones.

2. Endpoint Security

• Ensure all devices have updated antivirus/anti-malware solutions.
• Review patch management processes for timely updates.
• Verify that endpoint detection and response (EDR) tools are in place.

3. Access Control

• Review user access levels and enforce the principle of least privilege.
• Ensure multi-factor authentication (MFA) is enabled on all critical systems.
• Check if a role-based access control (RBAC) system is used.

4. Data Security

• Assess encryption policies for data at rest and in transit.
• Review data backup and recovery procedures.
• Confirm data classification policies and their enforcement.

5. Incident Response

• Verify existence and accessibility of an incident response plan.
• Review staff training for handling security incidents.
• Test incident detection and response through tabletop exercises.

6. Application Security

• Conduct static and dynamic application security testing (SAST/DAST).
• Review web application firewalls (WAF) for critical applications.
• Perform code reviews and vulnerability assessments on custom applications.

7. Identity and Access Management (IAM)

• Ensure strong password policies are in place (length, complexity, expiration).
• Verify proper management of administrative and privileged accounts.
• Conduct audits of user accounts, especially orphaned accounts.

8. Physical Security

• Review access control measures to server rooms and other sensitive areas.
• Check for surveillance and alarm systems for critical infrastructure.
• Assess secure disposal methods for physical assets (e.g., shredding documents, degaussing drives).

9. Email Security

• Ensure email filtering is in place for phishing and spam.
• Verify that Domain-based Message Authentication, Reporting & Conformance (DMARC) is configured.
• Assess email encryption for sensitive communications.

10. Cloud Security

• Check for proper configuration of cloud service settings and access controls.
• Review encryption policies for data stored in cloud environments.
• Ensure backup and disaster recovery solutions for cloud services.

11. Third-Party Vendor Security

• Review security practices of vendors with access to your systems.
• Ensure contracts include cybersecurity clauses and SLAs.
• Assess third-party vendor risk and conduct periodic audits.

12. Mobile Device Security

• Ensure mobile device management (MDM) policies are in place.
• Assess the encryption and remote wipe capabilities for mobile devices.
• Review policies for Bring Your Own Device (BYOD).

13. Compliance and Regulatory Requirements

• Ensure compliance with industry regulations (e.g., GDPR, HIPAA, CCPA).
• Conduct regular audits for compliance frameworks (e.g., NIST, ISO 27001).
• Ensure proper logging and documentation of compliance activities.

14. Security Awareness Training

• Verify that employees undergo regular cybersecurity training.
• Assess phishing simulation exercises and response rates.
• Review policies on handling sensitive information and reporting incidents.

15. Penetration Testing

• Conduct regular penetration tests on critical systems.
• Ensure external and internal penetration testing is performed by third parties.
• Review findings and address any identified vulnerabilities.

16. Wireless Network Security

• Verify encryption protocols (e.g., WPA3) for all wireless networks.
• Segregate guest and internal networks.
• Assess network security monitoring for wireless networks.

17. Backup and Disaster Recovery

• Ensure regular backups of critical data, both on-site and off-site.
• Test disaster recovery plans periodically.
• Review Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO).

18. Logging and Monitoring

• Ensure log aggregation and monitoring for critical systems.
• Implement Security Information and Event Management (SIEM) systems.
• Regularly review and analyze logs for suspicious activity.

19. Vulnerability Management

• Maintain up-to-date vulnerability scanning across the environment.
• Prioritize patching based on criticality of identified vulnerabilities.
• Ensure systems are patched regularly and within a timely manner.

20. Governance and Policy Management

• Review cybersecurity policies and ensure they are up to date.
• Conduct regular security assessments and risk management reviews.
• Establish a cybersecurity governance framework for decision-making.