Domain

Security Governance

This domain covers how your security governance is designed, implemented, and maintained.

01) Does your organisation conduct an annual independent information security review and act upon the findings?

Answer yes if your organisation engages a third party to conduct an annual information security review, the findings are assessed by your organisation and acted upon if necessary. If yes, add the date of your last review to the notes.

02) Does your organisation have an appointed person responsible for information security, such as a CISO?

Answer yes if your organisation has an appointed role that is responsible for managing and implementing security controls throughout your business. Please confirm the role and its responsibilities in the notes or upload a job role description as evidence.

03) Does your organisation have a documented Cybersecurity Policy or Information Security Policy?

Answer yes if your organisation has a documented Cyber Security Policy or Information Security Policy that has been reviewed in the last year. Please upload the Information Security Policy as evidence.

04) Does your organisation have a formal policy on the use of mobile devices?

Answer yes if your organisation has a documented Mobile Device Policy that has been reviewed in the last year. Please provide the Mobile Device Policy (as a PDF file) as evidence or reference a section of a previously provided Information Security Policy in the notes.

05) Does your organisation have a formal policy for remote working that includes security?

Answer yes if your organisation has a documented Remote Working Policy that has been reviewed in the last year. Provide the Remote Working Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

06) Does your organisation have a documented Acceptable Use Policy that outlines the rules for the acceptable use of company IT assets and information?

Answer yes if your organisation has a documented Acceptable Use Policy that has been reviewed in the last year. Upload the Acceptable Use Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

07) Does your organisation have a documented Information Classification Policy?

Answer yes if your organisation has a documented Information Classification Policy that has been reviewed in the last year and that outlines the data handling procedures in operation within your organisation. Upload the Information Classification Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

08) Does your organisation have a documented Access Control Policy?

Answer yes if your organisation has a documented Access Control Policy that has been reviewed in the last year. Upload the Access Control Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

09) Does your organisation have a policy governing the use of cloud services?

Answer yes if your organisation has a documented policy on the use of cloud services, and if it has been reviewed in the last year. The policy should include information security requirements for the acquisition, use, management, and exit from cloud services. Upload the Cloud Services Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

10) Does your organisation have a Password Policy that is technically enforced throughout its IT estate?

Answer yes if your organisation has a documented Password Policy which is enforced technically throughout the IT estate. Upload the Password Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes. Also include information about any controls you have to prevent brute-force attacks on passwords, such as account lockout thresholds or time-delays between password attempts.

11) Does your organisation have a documented Backup Policy?

Answer yes if your organisation has a documented Backup Policy that has been reviewed in the last year. Upload the Backup Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

12) Does your organisation enforce a Clear Desk and Screen Policy?

Answer yes if your organisation has implemented and enforces a Clear Desk and Screen Policy. Upload the Clear Desk and Screen Policy as evidence or reference a section of a previously uploaded Information Security Policy in the notes.

13) Does your organisation prevent the use of removable media, and is this enforced technically?

Answer yes if your organisation blocks the use of removable media on your network and if this is enforced through the use of a technical control.

14) If the use of removable media is not prohibited and enforced technically, is its use subject to other compensatory controls?

Answer yes if your organisation subjects the use of removable media to technical controls (these can include DLP solutions, encrypted USB drives, training and awareness etc.). If yes, please describe the nature of these controls within the notes.

15) Are your organisation's information security policies accessible to all employees?

Answer yes if all of your employee's have continuous access to your organisation's up-to-date policies (for example, through an intranet, cloud service, or networked drive).

16) Are your organisation's information security policies reviewed and approved by senior management at least annually?

Answer yes if all of your organisation's security policies are reviewed and approved by senior management.

17) Has your organisation documented senior management roles and responsibilities for security within your organisation?

Answer yes if your organisation has clearly defined and documented the security roles and responsibilities of senior management. Upload the documented roles as evidence.

18) Does your organisation include information security during the planning and delivery of projects?

Answer yes if you include information security in your planning and delivery of projects (for example, by conducting a security risk assessment of each project and implementing project controls).

19) Does your organisation restrict employee access to business information based upon the principle of least privilege?

Answer yes if you only give each employee access to the business information that they require to complete their job role (this is known as the principle of least privilege).

20) Does your organisation have an internal audit function that ensures information security requirements are being met by the business?

Answer yes if you have an internal team who audit your security function against your policies to ensure compliance. Please comment on the frequency of the audits in the notes.

21) Does your organisation use a defined methodology to identify, assess, prioritise and track the treatment of security risks to closure?

22) Is information security and cyber risk reported to your organisation's board (or equivalent senior governing body) as part of formal risk reporting, with findings tracked at that level?

Answer yes if information security and cyber risk is formally reported to your organisation's board, or equivalent senior governing body if no formal board exists, as part of your regular financial and operational risk reporting cycle (not simply discussed informally or reported to management below board level). Findings and identified risks should be tracked and reviewed at board level over time, not simply presented once. Describe the frequency and format of this reporting in the notes section (e.g. quarterly board risk report), or upload a redacted example/board paper as evidence.

23) Does your organisation have a formal confidentiality or non disclosure agreement in place for all staff, contractors and third parties?

Answer yes if you require everyone who has access to confidential information to sign a confidentiality agreement or NDA. Upload a template NDA or confidentiality agreement as evidence.

24) Does your organisation segregate duties to prevent unauthorised disclosure or access to information?

Answer yes if your organisation has identified and segregated relevant duties to help reduce errors and to prevent fraud. Please give an example of such segregation in the notes.

25) Does your organisation have a defined process that is followed when a client contract is terminated that includes the secure destruction of client data?

Answer yes if your organisation has a defined process for terminating a client contract and removing all relevant client data securely. Describe the process in the notes or upload a supporting document as evidence.

26) Does your organisation use threat intelligence to inform decisions about information security?

Answer yes if your organisation uses threat intelligence to make smarter decisions relating to information security strategy, policy, processes or operations. This could be collected, analysed and produced internally, or gathered from external sources such as information services or special interest groups. In the notes section, describe how you collect, analyse and use threat intelligence within your organisation, or upload a document as supporting evidence.

00) Does your organisation hold any certifications in information security?

Answer yes if your organisation has been certified to an information security standard (such as PCI DSS, Cyber Essentials or ISO27001) or has completed an information security audit such as a SOC2.

01) Is your organisation Cyber Essentials certified?

Answer yes if your organisation is certified to the first level Cyber Essentials scheme. Upload your Cyber Essentials certificate as evidence.

02) Is your organisation Cyber Essentials Plus certified?

Answer yes if your organisation has been certified to the Cyber Essentials Plus scheme by a relevant certification body. Upload your Cyber Essentials Plus certificate as evidence.

03) Is your organisation ISO27001 certified?

Answer yes if your organisation has a current, valid ISO27001 certification. Please provide your ISO27001 certificate and Statement of Scope as evidence (as a PDF file) and copy the certificate scope statement into the notes section.

04) Is your organisation aligned with the NIST Cybersecurity Framework?

Answer yes if your organisation is aligned with the NIST Cybersecurity Framework.

05) Does your organisation store, process, transmit or otherwise have the ability to impact the security of cardholder data (CHD) or sensitive authentication data (SAD)?

Answer yes if your organisation performs any activities or may otherwise impact the security of cardholder data or related sensitive authentication data related to payment processing. Cardholder data includes data such as the Primary Account Number, Cardholder Name, Expiration Date, and Service Code. Sensitive authentication data includes data such as full track data, card verification code, PINs, etc.

06) Has your organisation performed validation of compliance to the Payment Card Industry Data Security Standard (PCI DSS) v4 or above for your services or environments that impact cardholder data or sensitive authentication data?

07) Does your organisation have a defined process for managing and monitoring Third-Party Service Providers (TPSP) that provide services impacting your PCI DSS compliance?

08) Does your organisation have any other certifications or audit reports that cover information security (such as a SOC 2 report)?

Answer yes if your organisation has completed any other information security audits or certifications. If yes, please state the certification or report in the notes and please provide the relevant certification or report as evidence.

01) Does your organisation perform background checks on staff and contractors?

Answer yes if background checks are conducted against staff before they join your organisation. In the notes section, describe the types of checks (e.g. employer reference, criminal records, BPSS, CTC, SC, DV) conducted for which roles or upload a supporting document as evidence.

02) Do employment contracts include consenting to all information security responsibilities in line with organisational policies and procedures?

Answer yes if your organisation's employment contracts include a clause in which the employee must consent to abiding by all of your organisation's security policies. Upload a template contract as evidence or copy the clause into the notes section.

03) Do employees and contractors receive an information security and data protection training programme?

Answer yes if your organisation runs an information security and data protection training programme for all of your employees and third-party contractors. Describe the nature and frequency of the training programme in the notes section, including any additional training provided to staff with greater responsibility, more privileged system access or access to confidential data.

04) Is there a formal disciplinary process for employees who have breached company policy (including any breaches of company security policy)?

Answer yes if your organisation has a formal disciplinary process that is followed if an employee is found to have intentionally breached company policy. Upload a document outlining the process as evidence (this may be covered by your organisation's Disciplinary Policy).

05) Does your organisation have arrangements in place to provide an alternate resource when a member of staff is not available for an extended period of time?

Answer yes if your organisation has a process in place to source additional staff if one of your organisation's employees is not available for an extended period of time. Describe the process in the notes section.

01) Does your organisation keep an up-to-date inventory of all IT assets with assigned owners?

Answer yes if your organisation keeps an up-to-date inventory of all hardware and software assets within your IT estate, including cloud services. The inventory must list an owner against each asset. It should also list other details about the assets such as version numbers, business usage & location. Include details in the notes.

02) Does your organisation keep an up-to-date inventory of all data repositories (such as databases) with assigned owners?

Answer yes if your organisation keeps an up-to-date inventory of all data repositories within your IT estate, including any hosted within cloud services. The inventory must list an owner against each asset.

03) Does your organisation have a formal process to ensure that employees, contractors and third party users return all IT assets when they leave the organisation?

Answer yes if your organisation has a formal process that ensures employees, contractors and third party users return all IT assets when they leave the organisation (this usually takes the form of a checklist).

04) Does your organisation have a process for editing or removing employee access to systems and information (whether digital or physical) when they are changing role or leaving the organisation?

Answer yes if your organisation has a formal process that ensures all access to your organisation's systems & information (this includes, but is not limited to corporate endpoints, networks, offices and third party services) is removed when employees, contractors and third party users leave the organisation and is updated when they change roles. Describe these processes within the notes and/or upload any relevant evidence.

05) Does your organisation have a documented process for provisioning user accounts for all of your IT services that includes appropriate authorisation and secure account creation with unique user IDs?

Answer yes if your organisation requires all users to have a secure and unique logon to access corporate endpoints, networks, and third party services, and if these logons are provisioned securely and with line manager authorisation. Describe the provisioning process in the notes or upload a supporting document as evidence. If any generic or shared accounts are used, specify what these are used for and any processes you have in place to minimise their usage.

06) Does your organisation enforce multi-factor authentication on all remotely accessible services?

Answer yes if your organisation enforces multi-factor authentication on all remotely accessible services that are used internally or provided externally (e.g. to service users or the public). This includes internal IT services, third-party apps or systems provided externally (e.g. portals, apps, public services). In the notes section, describe where MFA is enforced, where it is available but not enforced, and where it is not available. You can add different answers for different products.

07) Are privileged access accounts, and accounts of a sensitive nature, subject to a higher level of authorisation than user accounts before being provisioned?

Answer yes if your organisation requires privileged user accounts and accounts for sensitive services (such as network administrators) to receive a higher level of authorisation before they are provisioned. Describe the provisioning process in the notes or upload a supporting document as evidence.

08) Does your organisation regularly audit employee access rights for all IT services (whether internal or third party based)?

Answer yes if your organisation conducts regular user access audits to make sure that all users have the correct and up-to-date access to business information. This should include audit of any shared or generic accounts. Describe the audit process in the notes section or upload a supporting document as evidence.

09) How many access audits does your organisation conduct each year, for regular employee accounts?

State the number of times access audits are completed for users each year.

10) How many access audits does your organisation conduct each year, for privileged employee accounts?

State the number of times access audits are completed for users each year.

11) Does your organisation use Privileged Access Management controls to securely manage the use of privileged accounts for system administration?

Answer yes if your organisation has systems and/or processes in place to help ensure privileged accounts are only used for the intended purposes, in a secure way. This could include the use of administration proxies (jump boxes or bastion hosts), Privileged Access Workstations (PAWs), temporary credentials, additional approval processes, or ensuring privileged accounts are not used for normal business activities, such as email or web-browsing. Describe your PAM controls in the notes section or upload a supporting document as evidence.

12) Do all of your organisations systems automatically lock after a short period of inactivity (requiring re-authentication)?

Answer yes if your organisation's systems automatically lock after a period of inactivity and require the user to reauthenticate.

13) For how many minutes does a user have to be inactive before the system is locked?

State how long a user must be inactive for (in minutes) before the systems lock. If times vary between systems, state the highest value and describe the others in the notes.

14) Does your organisation use/provision a password manager to ensure passwords are of the required complexity and only used once?

Answer yes if your organisation provides staff with a password management solution to help facilitate password complexity and uniqueness.

15) Has your organisation removed local administrator rights on all end point devices for all employees that do not require it?

Answer yes if your organisation provides users who do not require local administrator privileges with user accounts (without administrator rights) on their endpoint systems.

16) Does your organisation operate a secure configuration process to reduce any unnecessary vulnerabilities in your IT systems including servers, endpoints, network devices and systems hosted in a cloud environment?

Answer yes if your organisation has a configuration process that is followed for all IT assets. The process should define security settings and disable unneeded services, thereby reducing your attack surface. Please describe how your secure configuration process is performed, including both automated and manual checks. Please upload any relevant documentation (as a PDF file) as evidence.

17) Do all systems (such as network devices) have their default credentials changed on installation or provision?

Answer yes if all of your organisation's IT systems (network devices and user accounts for services) have their default credentials changed on installation or provision.

18) Does your organisation have a formal change management process that gives consideration to information security?

Answer yes if your organisation has a formal change management process that includes a step to assess any security risks that the change may impact, and that requires a rollback plan. Please provide a supporting document (as a PDF file) outlining the process, or describe the process in the notes section as evidence.

19) Does your organisation use anti-malware controls, such as an Endpoint Detection and Response (EDR) solution, to protect all of its endpoints and internal IT infrastructure?

Answer yes if your organisation has deployed anti-malware solutions on all user endpoints and IT systems, and if these solutions receive regular signature updates and are configured to scan files regularly (at least daily). Please provide details of your malware protection solutions in the notes section.

20) Does your organisation have procedures in place to control the installation of software on IT production systems (such as servers)?

Answer yes if your organisation has controls in place to monitor and restrict the installation of software on production systems (for example, through the use of application whitelisting on servers). Please describe the nature of the controls in the notes.

21) Does your organisation have procedures in place to control the installation of software on user endpoint systems?

Answer yes if your organisation has controls in place to monitor and restrict the installation of software on user endpoint systems, including desktop PCs, laptops & mobile devices. This could be done through the use of application whitelisting, restricting user installation rights, device management software etc. Please describe the nature of the controls in the notes.

22) Does your organisation enforce full-disk encryption on all organisation-provisioned endpoint devices?

Answer yes if your organisation allows the use of laptop devices for work purposes. In the notes, please describe whether these are typically company owned or personal devices.

23) Can your organisation perform a remote wipe on all organisation-provisioned endpoint devices?

Answer yes if your organisation enforces hard drive encryption on all laptop devices. In the notes, please include details of the encryption algorithm(s) used and how this is enforced.

24) Does your organisation allow staff to access company data or services from employee-owned devices?

Answer yes if your organisation allows employees or contractors to have apps or services that access company data on their personally-owned devices (e.g. mobile phones, tablets, laptops), commonly known as a Bring Your Own Device (BYOD) policy.

25) Does your organisation enforce equivalent technical security controls on BYOD endpoint devices before allowing access to company data or services?

Answer yes if your organisation enforces security controls on BYOD endpoint devices to an equivalent standard of the security controls on organisation-issued devices, before access to company data or services is granted. For example, this could be done through the use of containerised MDM or UEM software. In the notes, describe the nature of the controls, the method of enforcement and any related processes. If there is a difference in the level of control between organisation-issed devices and BYOD, describe that in the notes section, including any compensating controls.

26) Can your organisation perform a remote wipe of organisation data on all BYOD endpoint devices?

Answer yes if your organisation requires technical enforcement of security controls on mobile phones and tablets before access to company data or services is granted. For example, this could be done through the use of MDM (Mobile Device Management) software. In the notes, please describe the nature of the controls, the method of enforcement and any related processes.

27) Does your organisation encrypt client data on its IT systems using appropriate cryptographic standards?

Answer yes if your organisation encrypts client data on its IT systems. Please state the encryption algorithm used in the notes.

28) Which countries or jurisdictions is client data stored, processed, or transferred to or through?

List all countries or jurisdictions where client data (including personal data, confidential business information, or any other data provided by or generated for a client) is stored, processed, or transferred to or through. This includes the location of your own offices, data centres, and cloud infrastructure, as well as any sub-processors or subcontractors you use. For each country listed, describe in the notes section what data is stored or transferred there, under what circumstances, and any legal or contractual mechanisms in place to govern that transfer.

29) Does your organisation ensure that all IT systems are regularly patched with security patches in line with vendor recommendations, including end point devices, servers, network devices, and applications?

Answer yes if your organisation runs a patch management process to ensure that all IT systems (end points, servers, network devices, and applications) are updated with security patches in line with the manufacturer's guidance. In the notes section, describe your patch management process, including how you ensure all systems are in scope, and state the timeframes in which patches are applied for each severity level (e.g. critical, high, medium, low), based on the vendor's or a recognised severity rating (such as CVSS). If timeframes differ across system types (e.g. internet-facing vs internal systems), describe this too. Alternatively, upload supporting documentation such as a Patch Management Policy that provides the required details.

30) Does your organisation use any applications, operating systems or hardware that are no longer supported by the vendor and no longer receive security updates?

Answer yes if your organisation uses any IT systems that include applications, operating systems or hardware (including servers, network equipment or user devices) for which the vendors do not provide regular security updates. In the notes, please describe how you discover and manage these systems, including any compensatory controls you have in place to protect them and any plans for decommissioning or replacement.

31) Does your organisation ensure that all used digital media (that may have stored data) is disposed of securely and are certificates of destruction obtained?

Answer yes if your organisation has a process to securely destroy all media that may hold business information. If a third party is used, only answer yes if your organisation receives certificates of destruction. Please provide a document outlining the process (as a PDF file) as evidence or describe the process in the notes section.

32) Does your organisation take regular immutable backups of its digital production data in line with current best practise guidelines?

Answer yes if your organisation takes regular backups of its production data that cannot be altered, deleted or tampered with for a specified time period. Backups must be taken in line with best practice guidelines, for example by following the '3-2-1' rule and segregating the backups from your main environment. Please describe your backup processes including segregation, frequency, and any other controls in place.

33) Does your organisation encrypt the backups using appropriate cryptographic standards to prevent unauthorised access to the backup data?

Answer yes if your organisation encrypts the backups using appropriate cryptographic standards to prevent unauthorised access to the data. Please state the encryption algorithm used in the notes section.

34) Does your organisation regularly test backups to ensure their effectiveness?

Answer yes if your organisation regularly tests its backup data to ensure that the backups are effective and can be used when required. Please state the frequency of the tests in the notes section.

35) Does your organisation use opportunistic TLS on all email services and are you able to apply enforced TLS to specific domains on request?

Answer yes if your organisation uses opportunistic TLS by default and has the capability to configure enforced TLS on email services to specific domains if requested.

36) Has your organisation implemented SPF, DMARC, and DKIM for all of its email services?

Answer yes if your organisation has implemented effective SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance) records within its DNS services. Please state in the notes the type of DMARC policy set.

37) Does your organisation prevent unauthorised transfer of data via email, web browsers, or other data transfer mechanisms?

Answer yes if your organisation has any form of Data Loss Prevention (DLP) controls in place to ensure only authorised data is transferred outside of your organisation. In the notes, please describe the controls you have in place and how these are managed.

38) Does your organisation use email security controls to detect, filter or quarantine malicious inbound email before it reaches users?

Answer yes if your organisation has implemented email security controls that inspect inbound email and detect, filter, or quarantine messages that are likely to be malicious, such as phishing attempts, spoofed senders, or messages containing malicious attachments or links. This could include secure email gateways, native cloud email provider protections (e.g. Microsoft Defender for Office 365, Google Workspace security controls), or third-party email security solutions. Describe the nature of the controls in the notes section.

00) Does your organisation develop any applications or systems?

Answer yes if your organisation develops or programs any applications or systems.

01) Does your organisation control access to program source code in a secure manner?

Answer yes if your organisation controls access to its application source code. This is typically done by using a code repository with robust access controls implemented, including maintaining an audit log of all access.

02) Does your organisation have a documented and approved software development life-cycle (SDLC) process that includes security input?

Answer yes if your organisation has implemented a secure SDLC (Software Development Lifecycle) that includes a security risk assessment. Describe your SDLC process in the notes, highlighting any security input, or upload a supporting document as evidence.

03) Does your organisation develop applications and systems using security best practice (for example, by following the OWASP secure coding practices)?

Answer yes if your organisation's developers are instructed to build apps and systems using defined security best practice (for example, as defined by OWASP, The Open Web Application Security Project). Describe in the notes the best practice guidance followed and if your developers receive any additional security training.

04) Does your organisation validate all data inputs and outputs to and from its applications?

Answer yes if your organisation ensures that all of its applications have data validation implemented on their data inputs and outputs.

05) Does your organisation conduct threat modelling during the design phase of an application or system build?

Answer yes if your organisation conducts threat modelling when designing each app or system. Describe in the notes how threat modelling is integrated throughout your SDLC or upload a supporting document (for example, a template threat modelling report) as evidence.

06) Do all of your organisation's applications and systems use industry best practice for authentication, including storing all user passwords as appropriate hashes?

Answer yes if your organisation ensures that all of its apps and systems (that are developed/built in-house) use industry best practice for authentication, and that all passwords are stored as hashes using secure hashing algorithms rather than as plain text. In the notes section, where relevant, state the name of the authentication provider used.

07) Does your organisation conduct appropriate security testing as part of your development lifecycle?

Answer yes if your organisation performs security testing of all apps & systems during the build process. Describe the security testing performed which could include, but is not limited to Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Infrastructure security testing.

08) Does your organisation segregate development environments from any testing or production environments?

Answer yes if your organisation uses segregated environments for the development of apps, the testing of apps, and the hosting of production systems that handle live data. Describe in the notes the nature of the segregation (logical/physical).

09) Does your organisation use dummy test data when undergoing testing of systems (and not live production data)?

Answer yes if your organisation has made it policy to only use test data (rather than live production data) that contains no personal data when testing its IT systems. If not, please state the reason why and whether or not you have any other mitigating controls in place.

10) Does your organisation ensure that all apps that it builds are maintained with regular security patches?

Answer yes if your organisation produces regular security updates for any apps it develops and hosts.

11) Does your organisation conduct regular penetration tests of any applications or systems that it develops?

Answer yes if your organisation conducts regular penetration tests of any apps or systems that it develops and remediates the findings. Describe how often penetration tests take place.

12) Does your organisation ensure that appropriate logging and monitoring is in place for all applications or systems it develops?

Answer yes if your organisation ensures that any applications or systems developed have appropriate logging mechanisms implemented (for example, as defined by OWASP, the Open Web Application Security Project).

14) Is your organisation able to demonstrate the composition and provenance of software it develops (including third-party and open-source components)?

Answer yes if your organisation can demonstrate the composition and provenance of the software it develops, including any third-party or open-source components. Upload supporting evidence such as, but not limited to: a software inventory, dependency lists, or a software bill of materials (SBOM).

15) Does your organisation continuously monitor all software components for vulnerabilities?

Answer yes if your organisation has processes or tools in place to regularly monitor software components for newly disclosed vulnerabilities throughout the software lifecycle. This includes identifying relevant vulnerabilities, understanding the potential impact to you, and assessing any necessary actions.

16) Does your organisation provide a clear way for third parties to report security vulnerabilities in your software, products or services?

Answer yes if your organisation has a documented and publicly accessible vulnerability disclosure process that allows external researchers, customers, or other third parties to report suspected security vulnerabilities in your software. Describe this process in the notes section, including expected response times, or upload the policy as evidence.

17) Does your organisation control and authorise all access to data and services in your software, products or services?

Answer yes if your software, products or services have a well-defined account model, and all access to data and functionality (including via APIs and administrative interfaces) requires authentication and authorisation. No data or functionality should be reachable by an unauthenticated user by default. Describe the account model and authorisation mechanisms in the notes section, or upload supporting documentation such as an architecture diagram.

19) Does your organisation implement role-based access controls, based on the principle of least privilege, in your software, products or services?

Answer yes if user roles and permissions within your software, products or services are configurable or enforced so that users only get the minimum access needed for their role. Describe the roles available and how permissions are assigned in the notes section, or upload a role/permission matrix.

20) Does your organisation enforce a modern password policy for user access to your software, products or services?

Answer yes if user accounts in your software, products or services are subject to a modern password policy, for example minimum length, no forced periodic rotation, and checks against known-breached passwords. Describe the password policy in the notes section.

21) Does your organisation enforce multi-factor authentication (MFA) for user access to your software, products or services?

Answer yes only if MFA is enforced for all user access. If MFA is merely available or configurable for clients to turn on themselves, rather than enforced by default, answer no. Describe how MFA is enforced in the notes section.

22) Does your organisation support Single Sign-On (SSO) or another federated identity mechanism for your software, products or services?

Answer yes if users can connect their own identity provider (e.g. via SAML or OIDC) to your software, products or services so they can provision, modify and revoke user access themselves. Describe the supported protocols and any limitations in the notes section.

23) Does administrative or privileged access within your software, products or services carry additional controls beyond standard user access?

Answer yes if administrators, meaning anyone who can access other users' data, change security settings, or manage the underlying service, are held to a higher standard than ordinary users, for example time-limited elevation, approval workflows, or separate privileged accounts. Having an admin role is not sufficient on its own - this is about the extra controls around that access. Describe the mechanisms in place in the notes section.

"*****Only if Yes to E12***** 13) Is this logging and monitoring used to detect unauthorised changes to applications or system components?"

Answer yes if your logging and monitoring capabilities either directly or are fed into systems to detect unauthorised or unexpected changes to the components that make up your applications or systems. Describe the tools or mechanisms used and how alerts are triaged in the notes section.

"*****Only if Yes to E17***** 18) Are service credentials for your software, products or services rotated regularly, and can they be revoked promptly if compromised?"

Answer yes if service credentials used to authenticate to your software, products or services, such as API keys, service account secrets or certificates, are rotated on a defined schedule and can be revoked promptly if compromised or no longer needed. Describe your rotation and revocation processes in the notes section.

00) Does your organisation run any of its own servers, networks or cloud systems?

Answer “Yes” if your organisation runs websites, apps or tools, either on your own self-hosted servers and networks, or in the cloud, such as on AWS, Azure, or GCP. This includes anything you set up or manage yourself, even if it's in the cloud or supported by an outsourced provider.

01) Are all ingress and egress points for traffic through your network or cloud environment protected by firewalls?

Answer yes if your organisation has secured all of the ingress and egress points of its corporate network and IT environments (cloud-based or otherwise) with firewalls - whether as discrete appliances or as cloud-hosted network security service functions.

02) Were the firewalls implemented using a deny all policy, with rules built around your organisation’s requirements?

Answer yes if the firewalls were implemented with a 'deny all' policy, and each rule was only added when a business requirement was identified, documented and approved by an authorised individual.

03) Does your organisation review its firewall rules at least annually?

Answer yes if your organisation undertakes an annual firewall rule review in which it removes any redundant rules and makes sure that all of the rules are relevant to its business operations. State the date of the last review.

04) Does your organisation have web application firewalls (WAFs) implemented to protect web applications?

Answer yes if all web applications hosted by your organisation are protected with WAFs (web application firewalls) - whether as discrete appliances or as cloud-hosted network security service functions. If your organisation does not host any web applications, answer 'No' and state this in the notes section.

05) Were the WAFs implemented with rulesets that have been built or tailored to your organisation’s requirements?

Answer yes if the WAFs have been implemented with a ruleset that has been tailored to your specific business requirements for the applications that you are protecting.

06) Does your organisation review its WAF rules at least annually?

Answer yes if your organisation undertakes an annual WAF rule review in which it removes any redundant rules and makes sure that all of the rules are relevant to its business operations. State the date of the last review.

07) Has your organisation appropriately implemented segmentation or segregation in your networks and/or cloud environments?

Answer yes if your organisation has appropriately segregated its network or cloud environments to restrict the level of access to sensitive information, hosts, and services. This should include, but not limited to: segregation of production systems from non-production systems (e.g. those being commissioned, decommissioned, or under test); segregation of systems by security level or business unit (e.g. those processing sensitive personal or financial data are segregated from other business systems); and segregation of services used by different clients or subsidiary organisations.

08) Does your organisation place all publicly accessible services in isolated network DMZs (or separate subnets)?

Answer yes if your organisation hosts all publicly accessible services within a DMZ (a DMZ or demilitarised zone is a public facing subnet that acts as a barrier between your organisation's internal environment and the internet or other public network).

09) Does your organisation have any controls implemented to protect it against Denial of Service (and Distributed Denial of Service) attacks?

Answer yes if your organisation has implemented controls to protect its services against DOS (Denial of Service) and DDOS (Distributed Denial of Service) attacks. Describe the nature of these controls in the notes section.

10) Does your organisation secure and encrypt remote connections to its network or environment using an appropriate control/protocol (for example, by using VPNs or SSH connections)?

Answer yes if your organisation forces all remote connections to its network infrastructure or cloud environment to be secured with a suitable solution such as a VPN or SSH connection. Describe the nature of these controls in the notes section, both technical and procedural.

11) Does your organisation secure and encrypt all data transfers using an appropriate control/protocol (for example, SFTP, HTTPS), and are all data transfers subject to review and authorisation?

Answer yes if all data transfers to and from your organisation are approved by relevant parties and secured with an appropriate level of authentication and encryption (such as HTTPS for web traffic including APIs and SFTP for file transfers). Describe the nature of these controls in the notes section, both technical and procedural.

12) Does your organisation encrypt all data in transit as it flows between internal components within your services (for example, between application servers and databases)?

Answer yes if your organisation encrypts all data in transit as it moves between the internal components that make up your service(s). This is distinct from the two previous questions, which cover data crossing your organisation's network boundary. Describe the encryption standards and protocols used for internal component-to-component traffic in the notes section, or upload supporting documentation.

13) Does your organisation encrypt all client data at rest by default in the product or service you provide to clients, including any metadata derived from that data?

Answer yes if all client data held within the product or service, including any metadata generated or derived from it, is encrypted at rest by default using appropriate cryptographic standards. Describe the encryption standards used in the notes section.

14) Does your organisation manage and control the use of, and access to, any cryptographic keys?

Answer yes if your organisation controls the use of, and access to, cryptographic keys. These keys are typically used to access IT infrastructure and services. Describe the process in the notes section, or upload a supporting document as evidence.

15) Does your organisation secure remote access to its network or cloud environment using multi-factor authentication?

Answer yes if your organisation requires multi-factor authentication for all users accessing internal networks or cloud environments remotely.

16) Does your organisation keep a list of approved network connections (such as site to site VPNs) between your corporate network and third parties?

Answer yes if your organisation keeps a list of approved network connections between its own network and any third party networks.

17) Is each of the approved network connections subject to a risk assessment?

Answer yes if your organisation completes a risk assessment for each identified network connection between your network and any third party network.

18) Is each of the approved network connections subject to regular review?

Answer yes if your organisation undertakes a regular review of network connections (e.g. annually) in which it removes any redundant connections and makes sure that all of the connections are relevant to its business operations.

19) Does your organisation conduct regular automated vulnerability scans of its public facing IT infrastructure and remediate any findings?

Answer yes if your organisation conducts regular external automated vulnerability scans of its public IP infrastructure and remediates the findings.

20) How many external automated vulnerability scans does your organisation conduct each year?

State the number of automated scans completed every year.

21) Does your organisation conduct regular automated vulnerability scans of its internal IT infrastructure and remediate any findings?

Answer yes if your organisation conducts regular automated vulnerability scans of its internal IP infrastructure and remediates the findings. This may include scanning assets in a private local network or using a cloud service provider’s tools to scan for vulnerabilities in your cloud infrastructure.

22) How many internal automated vulnerability scans does your organisation conduct each year?

State the number of automated scans completed every year.

23) Does your organisation conduct regular penetration tests of its public facing IT infrastructure?

Answer yes if your organisation conducts regular penetration tests of your public facing IT systems and infrastructure and that you remediate the findings. The test should include manual testing by a skilled person in the role of a threat actor with technical verification and validation of any findings. Describe in the notes how often these tests are completed. Upload your last pentest report summary (not the detailed findings) as evidence.

24) Does your organisation conduct regular penetration tests of its internal systems where the test assumes perimeter controls have been compromised?

Answer yes if your organisation conducts regular penetration tests of your internal IT systems and infrastructure and that you remediate the findings. The test should include manual testing by a skilled person in the role of a threat actor with technical verification and validation of any findings. The test should assume that perimeter controls have been compromised, for example that a legitimate internal user’s credentials have been stolen and re-used. The test should assess a threat actor’s ability to reach assets and information, including opportunities to elevate privileges to gain access. The results of the tests can inform improvements to IT systems and infrastructure, for example improved subnet segregation and role access privileges and controls. Describe in the notes how often these tests are completed. Upload your last pentest report summary (not the detailed findings) as evidence.

25) Does your organisation have processes in place to triage and remediate identified vulnerabilities by inputting them into the relevant workflows?

Answer yes if you have processes in place which facilitate effective triage of vulnerabilities and input necessary remediations into the appropriate workflows, for example, development, IT change management or ad-hoc improvement programmes. This should cover all vulnerabilities identified through scanning, penetration tests, or other inputs such as external alert feeds or internal employee reporting. It should also include communication of vulnerabilities to key stakeholders (including relevant clients) where temporary compensating controls may be required. Describe your process(es) in the notes section.

26) Has your organisation implemented any network or cloud monitoring controls such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), or Security Information and Event Management (SIEM) systems?

Answer yes if your organisation has implemented any network or cloud monitoring solutions (either in house or via a third party service provider). Describe which solutions you have in place and the coverage they have over your network(s) or cloud environment(s).

27) Does your organisation have defined processes in place to ensure that all security alerts from logging and monitoring solutions are reviewed and actioned as necessary?

Answer yes if your organisation has processes in place to frequently review and act upon events and alerts from security logs and monitoring tools. Describe your processes for different types of security logs and events in the notes section.

28) Does your organisation monitor the capacity of its systems processing client information to make sure they are able to cope with load?

Answer yes if your organisation has controls in place to monitor the capacity of its IT production systems to make sure that they can cope with the load. Describe the controls in the notes section.

29) Does your organisation record and store user activity logs for all cloud environments, networks and associated services?

Answer yes if your organisation records and stores user activity logs for its IT production systems, network devices and endpoint devices.

30) For how many months does your organisation store its user activity logs?

State how many months the logs are kept for.

31) Does your organisation record and store the logs of root/super user/administrator actions for the network and associated services?

Answer yes if your organisation records and stores administrator activity logs for its IT production systems, network devices and endpoint devices.

32) For how many months does your organisation store its root/super-user/administrator logs?

State how many months the logs are kept for.

33) Are all logs stored on a secure/hardened server that is logically separate from the systems being logged?

Answer yes if your organisation stores all recorded logs on dedicated servers that are logically separate from your production systems, and hardened.

34) Does your organisation have a process to test the deployment of business critical applications to their target managed environment (cloud or on-prem) to ensure there are no adverse impacts on operations or security?

Answer yes if your organisation has a robust testing process implemented to appropriately test the deployment of business critical applications to their target managed environment (cloud or on-prem) to ensure there are no adverse impacts on operations or the security of your IT estate. Describe the nature of the testing process in the notes or upload a supporting document as evidence.

35) Is your organisation currently registered with the UK National Cyber Security Centre’s (NCSC) Early Warning service?

Answer yes if your organisation has registered with NCSC's Early Warning Service to receive notifications of potential threats to your network.

36) Have you ensured that access to management interfaces for your boundary firewalls or other edge devices is appropriately secured?

Answer yes if management interfaces (used for configuration and management tasks) for firewalls or other edge devices are only accessible through secure channels, and not directly from the public internet. Where remote access is required for a documented business need, it should be only be accessible through a combination of additional security controls such as a VPN, trusted IP addresses, MFA, etc.

00) Does your organisation rely upon any physical premises, such as offices, warehouses or data centres?

Answer yes if your organisation uses any physical premises in order to provide your services, products or to run your operations. This could include, but is not limited to, office space, warehouses, or data centres. It includes data centres used to host cloud services provided by your organisation, even if you do not have direct control of those premises. It also includes office space used by your people, even if you are a cloud-first organisation.

01) Does your organisation enforce a secure physical perimeter around all of its physical locations (e.g. offices, data centres...)?

Answer yes if your organisation has implemented a secure physical perimeter around all of its physical locations. Upload a Physical Security Policy document as evidence or reference a section of a previously uploaded security policy in the notes.

02) Does your organisation use CCTV to monitor entry and exit points of all premises?

Answer yes if your organisation uses CCTV cameras on all of its premises entry and exit points.

03) For how many days does your organisation keep CCTV footage?

State the number of days that the CCTV footage is kept for. If different retention times are used depending on the CCTV system, state the different retention times in the notes and enter the lowest retention time in the answer box.

04) Does your organisation use an access control system on it's premises entry and exit points that includes logging of access?

Answer yes if your organisation uses an access control system to control the movement of people in and out of its physical premises, and if this system keeps a digital log of access.

05) For how many months does your organisation keeps its physical access control audit logs?

State the number of months that the access logs are kept for. If different retention times are used depending on the access control system, state the different retention times in the notes and enter the lowest retention time in the answer box.

06) Are all of your organisation's physical premises secured with an alarm?

Answer yes if all of your organisation's physical premises are secured with an alarm that once triggered, is investigated either by a private security team or the police.

07) Are all of your organisation's physical premises staffed 24/7 by a security team or reception team?

Answer yes if all of your organisation's physical premises are staffed 24/7 by an onsite security team, reception team, or both. If security is present for some hours (not 24/7), answer no and state in the notes section the times during which the premises are staffed.

08) Does your organisation use visitor log books (or the digital equivalent) to record visitors at all premises?

Answer yes if your organisation uses a physical or digital system to record the arrival of visitors, and the time at which they leave the premises.

09) Does your organisation require visitors to undergo an ID check on arrival at all premises?

Answer yes if your organisation requires all visitors to undergo an ID check on arrival to ensure that they are the person that they claim to be.

10) Does your organisation protect sensitive equipment from power failures?

Answer yes if your organisation uses controls (such as Uninterruptible Power Supplies, UPS) to protect sensitive equipment from power failures.

11) Does your organisation ensure confidential paper waste is disposed of securely?

Answer yes if your organisation disposes of all confidential paper waste in a secure manner (typically either by shredding or incineration), or if a third party is used to dispose of the waste securely.

01) Does your organisation have a documented Incident Response Plan?

Answer yes if your organisation has a documented Incident Response Plan that has been reviewed in the last year. Upload the Incident Response Plan as evidence.

02) Does your organisation's Incident Response Plan allow for the classification of information security events?

Answer yes if your organisation's Incident Response Plan contains a section for classifying information security events. Reference the section of any previously uploaded plan in the notes.

03) Does your Incident Response Plan include consideration of legal and regulatory commitments?

Answer yes if your organisation's Incident Response Plan contains an assessment of impact to legal and regulatory compliance. Reference the section of any previously uploaded plan in the notes.

04) Does your organisation's Incident Response Plan include roles and responsibilities in the event of an incident?

Answer yes if your organisation's Incident Response Plan contains a section defining roles and responsibilities in an information security event. Reference the section of any previously uploaded plan in the notes.

05) Does your organisation's Incident Response Plan include alternative communication systems in case your usual systems are disrupted?

Answer yes if your organisation's Incident Response Plan contains a section for alternative communication methods. Reference the section of any previously uploaded plan in the notes.

10) Does your organisation conduct a root cause analysis for all information security incidents that are reported?

Answer yes if your organisation completed a root cause analysis for all security incidents that are reported, and implements any lessons learnt after each analysis has been completed. Upload a template root cause analysis document as evidence.

11) Does your organisation have an approved Business Continuity Plan to ensure the continuity of service in a disaster?

Answer yes if your organisation has a documented business continuity plan that has been reviewed and approved by senior management in the last year. Upload the Business Continuity Plan as evidence.

12) Is your organisation's Business Continuity Plan based on a current risk assessment of your business?

Answer yes if your organisation has assessed the potential business-disruptive risks and used this assessment to inform your Business Continuity Plan. This process may involve conducting a Business Impact Analysis (BIA) for certain scenarios. Upload the business continuity risk summary as evidence or reference a section of a previously uploaded document in the notes section.

13) Does your organisation's Business Continuity Plan address the backup and restoration of your business data and the data you process for your clients?

Answer yes if your organisation's Business Continuity Plan includes the required steps to backup and restore the data used by your organisation for day to day operations and the data your clients may have transferred to you for processing, including the outcomes of that processing. This may include defining and agreeing the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for certain services.

14) Does your organisation's Business Continuity Plan include operation of business activities from an alternative location?

Answer yes if your organisation's Business Continuity Plan includes the required steps to continue business operations from an alternate location if the normal business location is inaccessible.

15) Does your organisation's plan include the maintenance of security controls in a disaster?

Answer yes if your organisation's Business Continuity Plan includes information describing the maintenance of security controls in the event of a disaster.

16) Does your organisation have a programme in place to regularly rehearse and maintain your Business Continuity and Disaster Recovery plans?

Answer yes if your organisation runs rehearsal of its Business Continuity and Disaster Recovery plans regularly (e.g. annually) involving all parties, including senior operational leaders. Upload a report that details the last two tests to take place. In the notes section, describe the nature of the exercises (e.g. desktop exercises, partial or whole practical/technical service restoration and recovery) and who was involved. Also describe the outcome of the rehearsals, e.g. plans have been updated and re-issued with all material findings addressed.

17) Has your organisation set Recovery Time Objectives (RTO) and / or Recovery Point Objectives (RPO)?

Answer yes if your organisation has specified Recovery Time Objectives (RTO) and / or Recovery Point Objectives (RPO) for any of your services.

18) What is your Recovery Time Objective (RTO) in hours?

Please enter your Recovery Time Objective (RTO). If you have different RTOs for different services, please enter the longest RTO and provide details in the notes section.

19) What is your Recovery Point Objective (RPO) in hours?

Please enter your Recovery Point Objective (RPO). If you have different RPOs for different services, please enter the longest RPO and provide details in the notes section.

21) Does your organisation have cyber insurance?

Answer yes if your organisation holds a valid cyber insurance policy. Please provide the certificate of insurance (as a PDF file) as evidence.

23) Does your organisation maintain an understanding of the data important to the operation of your essential function(s), including where it is stored, where it flows (including to and from third parties), and the impact that an incident would have on the essential function(s)?

Answer yes if your organisation maintains an understanding of the critical data sets that underpin its critical operations, and the impact to those operations if that data were corrupted, unavailable, or otherwise inaccessible.

7) Does your organisation have a cyber incident response and forensic capability (either internally or via a third party or cyber insurance policy)?

Answer yes if your organisation has a cyber incident response capability that it can call upon in the event of an incident. This can be an in-house capability or provided by a third party or cyber insurance provider.

8) Does your organisation have a process for employees, contractors, suppliers, or any external entities to report suspected or known information security breaches and weaknesses?

Answer yes if your organisation has a documented process for reporting information security incidents, or suspected information security incidents (this is typically via an IT helpdesk). Describe the process in the notes, or upload a process document as evidence.

9) Does your organisation have a process for reporting information security breaches to affected clients in a timely manner?

Answer yes if your organisation has a documented process for reporting information security breaches to all affected Clients within 72 hours of the breach being discovered. Describe the process in the notes, or upload a process document as evidence.

"***Only if Yes to H1*** 6) Does your organisation's Incident Response Plan get tested through regular exercises, incorporating lessons from past incidents (including those affecting other organisations) and scenarios informed by threat intelligence and your own risk assessment?"

Answer yes if your organisation's Incident Response Plan is tested through regular exercises grounded in real inputs rather than generic templates. This includes drawing on the organisation's own past incidents, publicly known incidents affecting comparable organisations, current threat intelligence, and the organisation's own risk assessment findings.

"***Only if Yes to H18*** 20) Did your organisation's most recent Business Continuity/Disaster Recovery test meet its defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)?"

"Answer yes if the most recent rehearsal of your Business Continuity and Disaster Recovery plans successfully achieved your defined RTOs and/or RPO. If the test did not meet one or both objectives, answer no and describe in the notes section the extent of the shortfall, the root cause identified, and any remediation actions taken or planned as a result. If different services have different RTOs/RPOs and results varied, describe this in the notes section."

"***Only if Yes to H21*** 22) What is the limit of your organisation's cyber insurance policy (in GBP)?"

Please state the limit of the cover in GBP (if in another currency, please convert to GBP).

01) Does your organisation have formal agreements in place to control third party use of personal data, including any requirements stipulated by relevant data protection legislation?

Answer yes if your organisation ensures that all third parties with access to client data have a formal agreement in place that covers all of the requirements of the relevant data protection regulations (e.g. GDPR, Australian Privacy Act, US State Law).

02) Does your organisation have formal agreements in place that have appropriate security clauses, including a right to audit and mandatory adherence to security policies?

Answer yes if your organisation ensures that all third parties with access to client data have a formal agreement in place that contains appropriate security clauses including the right to audit and mandatory adherence to appropriate security policies.

03) Does your organisation conduct a business impact assessment for each supplier and give them a corresponding criticality rating?

Answer yes if your organisation assigns each supplier with a criticality rating that is based on a corresponding business impact assessment.

04) Does your organisation have a supplier security policy that outlines the security requirements that your suppliers are expected to meet?

Answer yes if your organisation has documented the baseline level of security controls that it expects its suppliers of different criticalities to adhere to. The Risk Ledger platform can be used for this - get in touch!

05) Does your organisation conduct security due diligence against suppliers before entering into a contract?

Answer yes if your organisation checks that each supplier has the required level of security in controls in place before it enters into a contract with them. The Risk Ledger platform can be used for this - get in touch!

06) Does your organisation conduct regular assurance activities against suppliers to ensure they are meeting their information security requirements?

Answer yes if your organisation checks that suppliers are continually meeting their security requirements whilst you are in contract with them, through regular assurance process (e.g. quarterly, annually). Provide details of your current process. The Risk Ledger platform can make this easier for you - get in touch!

00) Does your organisation collect, process, or store personal data, other than that of your own employees?

Answer yes if your organisation collects, processes or stores information that relates to an identified or identifiable individual. You need not answer yes if the only personal data you process is that of your own employees for HR requirements. Data collection also includes any identifiable information collected from web cookies.

01) Which countries do you store personal data in, or transfer personal data to?

List all countries where personal data controlled or processed by you resides or is transferred to or through. This includes the location of your head office and datacentres, as well as locations of sub-processors. For each country listed, describe what data is stored or transferred and under what circumstances.

02) Do you use appropriate legal mechanisms for all international transfers of personal data?

Answer yes if you have processes in place to ensure that every cross-border transfer of personal data has the appropriate contractual / legal mechanisms in place, depending on your jurisdiction. For example, this could be an international data transfer agreement, or an adequacy decision. Describe in the notes section which mechanism is used for which instances of data transfer.

03) Has your organisation been subject to any personal data access requests from governments or other authorities in the last 24 months?

Answer yes if your organisation has received a request from any government or other authority to provide access to personal data. Provide information about the nature, volume and origin of requests, including how many you complied with in the notes section, or through supporting evidence (e.g. a link to your transparency report or a document upload).

04) Does your organisation have a nominated Data Protection Officer (DPO)?

Answer yes if your organisation has a nominated Data Protection Officer (DPO) who undertakes regular compliance checks and leads on continual privacy improvement. Describe in the notes section details about how your DPO monitors compliance with relevant data protection obligations.

05) Does your organisation have an up-to-date Data Protection Policy?

Answer yes if your organisation has a Data Protection Policy that has been reviewed in the last year. Upload your Data Protection Policy as evidence.

06) Does your organisation maintain a record of all personal data collection & processing activities?

Answer yes if you document your personal data processing activities. This could be through data flow diagrams or written documentation and should include details of collection, purpose, storage, access, use, sharing, and retention. Describe how you do this in the notes.

07) Has your organisation defined and documented the lawful basis of each instance of personal data collection or processing?

Answer yes if your organisation has documented the legal justification for processing personal data in each instance. The criteria for a valid lawful basis will depend on your jurisdiction.

08) Does your organisation conduct a Data Protection Impact Assessment (DPIA) for all processing that is likely to result in a high risk to individuals?

Answer yes if your organisation conducts a Data Protection Impact Assessment (DPIA) for all processing of personal data that is likely to result in a high risk to individuals. To find out more about Data Protection Impact Assessments, see the Risk Ledger Knowledgebase.

09) Can your organisation facilitate an individual's data privacy rights?

Answer yes if your organisation has the correct processes in place to be able to provide the relevant individual data privacy rights to all of the data subjects for whom you hold data (e.g. the right to subject access, the right to erasure…).

10) Does your organisation have a Records Retention Policy?

Answer yes if your organisation has a Records Retention Policy that has been reviewed in the last year. Upload your Records Retention Policy evidence.

11) Does your organisation have robust detection, investigation and reporting procedures in place for personal data breaches, including maintaining a record of all personal data breaches?

Answer yes if organisation has robust detection, investigation and reporting procedures in place for all personal data breaches. This should include assessing the likely risk to individuals as a result of the breach, informing affected individuals without undue delay, and documenting the facts surrounding personal data breaches in a Breach Log. Provide details about your processes surrounding a personal data breach in the notes section, including uploading any relevant documentation.

12) Does your organisation have a process for notifying the relevant Authority and all relevant parties (e.g. data controllers) when a breach occurs?

Answer yes if your organisation has a documented process for notifying the relevant Authority for your jurisdiction and all data controllers or other relevant parties when it becomes aware of a security breach involving Personal Data.

13) Has your organisation suffered a security incident that led to a Personal Data breach in the last 6 months?

Answer yes if your organisation has had a security incident that led to a Personal Data breach in the last 6 months. If you answered yes, please describe the nature of the breach in the notes section and attach a root causes analysis report (as a PDF file) for each listed breach.

14) Does your organisation process personal data on behalf of another organisation?

Answer yes if your organisation processes personal data on behalf of another organisation where they are the data controller and you are the data processor.

15) Does your organisation have procedures in place to inform and obtain authorisation (if required) from the data controller before engaging a sub-processor?

Answer yes if you have ways to ensure that new sub-processors are authorised by or communicated to the data controller before the new sub-processing takes place. Upload evidence or describe how this is ensured in the notes.

16) Does your organisation ensure that processing activities are only carried out under the documented instructions of the data controller?

Answer yes if you have processes or policies which ensure data is only processed in the way in which your data controller has requested, and you have written instructions from the controller describing this. Describe in the notes how you obtain these instructions from data controllers and how you ensure data is not processed in any way outside of the documented written instructions.

01) Does your organisation have a documented AI Policy?

Answer yes if your organisation has a documented AI Policy that describes your organisation’s approach to using AI, including information such as, but not limited to: governance, roles and responsibilities, and policies describing the responsible use of AI technologies. Upload the AI Policy as evidence. In addition, if your policy adheres to any AI risk management frameworks (e.g. ISO/IEC 42001, EU AI Act, NIST AI RMF), state this in the notes section and upload relevant documentation as evidence.

02) Does your organisation use Machine Learning or Generative Artificial Intelligence (AI) models for internal use-cases?

Answer yes if Machine Learning or Generative AI models are used anywhere within your organisation. This includes the use of AI features or capabilities embedded in your supplier's services or any SaaS tools your people use (e.g. Google Gemini or Microsoft's Copilot). Unless it has been specifically prohibited and the restriction technically enforced, it is likely that AI is being used somewhere within your organisation and you should answer yes to this question.

03) Has your organisation conducted a risk assessment of each internal use of AI models?

Answer yes if your organisation has conducted and documented a regulatory compliance and security risk assessment for each AI-supported service that is used, including both internally developed and supplier-provided services. Examples of risk assessment considerations include: how a Large Language Model (LLM) service operates and is secured compared with the requirements of EU AI Act or the OWASP Top 10 for LLM, an evaluation of output accuracy or bias countermeasures, abuse prevention measures, and risk of Intellectual Property or Copyright infringement claims resulting from public use of AI-generated output.

08) Does your organisation embed Machine Learning or Generative AI (AI) capabilities within any service(s) you provide to clients?

Answer yes if AI is used to deliver or support any part of the service(s) you provide to clients, whether or not it is marketed as a distinct feature or the client is aware of it (e.g. an AI copilot, automated triage, generative content, or AI used internally in service delivery, such as AI-assisted QA or support processes).

10) Do your AI or AI-supported service(s) encourage service users to evaluate the AI model’s responses before use?

Answer yes if you have ensured, as far as you are able, that users of your service review and evaluate AI model output before use. This helps mitigate the risk that inaccuracies or 'hallucinations' in AI outputs go unchecked and mislead decision-making. Depending on the service, this could include tagging output as 'AI generated' or providing workflows that enable review, along with documenting the system's known limitations and guidance for how users should interpret its output. Upload a supporting document outlining these measures, or describe them in the notes section.

11) Is client data processed by the AI model discarded and erased from memory when processing of that data has completed?

Answer yes if client data processed by the AI model is discarded at completion of each defined processing purpose (for example, text input discarded after the processing of each specific Large Language Model prompt).

12) Is sensitive data (including personal or confidential data) removed, masked or otherwise prevented from being input into AI models for all services you provide?

Answer yes if you have controls in place to ensure that sensitive data is not processed by AI. This could include any data that has been defined by your customers as confidential, for example intellectual property or commercially sensitive information, in addition to personal information. These controls may include identifying and pre-treating data before AI processing or other controls to prevent the input of certain information. Please describe how this is achieved in the notes section.

13) Is client data and information (e.g. prompts) used to train AI models?

Answer yes if any client data is used to train your AI model, or external AI models used to provide supplier services. Please describe which client data may be used to train AI models and how this is communicated to those clients.

14) Is client data, and any AI model trained or fine-tuned using it, kept segregated so that it is not accessible to your other clients or to your AI model providers beyond what is required to deliver that client's own service?

Answer yes if client data, and any model trained or fine-tuned on it, is segregated from other clients and not accessible to or reused by your AI model providers beyond what's needed to deliver that client's service (e.g. not used to improve the provider's models for other customers). Describe how this is enforced (isolated model instances, access controls, contractual restrictions) or upload evidence.

15) Does your organisation have a formal AI model change management process that gives consideration to information security and regulatory requirements and includes notification to relevant clients?

Answer yes if your organisation evaluates the effects of changes of the underlying AI Model, whether that model is created and maintained by you or is adopted and applied from an external source (e.g. Amazon Bedrock AI as a Service). Change impacts can include changes in output accuracy or bias and the potential need to reprocess historic data for analysis consistency. Please describe how you evaluate the effects of these changes or upload supporting documentation (as a PDF file).

16) Does your organisation have processes in place to identify, triage and remediate the effects of AI model updates?

Answer yes if your organisation evaluates the effects of changes of the underlying AI Model, whether that model is created and maintained by you or is adopted and applied from an external source (e.g. Amazon Bedrock AI as a Service). Change impacts can include changes in output accuracy or bias and the potential need to reprocess historic data for analysis consistency. Describe how you evaluate the effects of these changes or upload supporting documentation.

17) Is client data otherwise exposed to Machine Learning or Generative AI models outside of the direct AI-enabled service(s) your client has purchased (for example, through internal tools used by your staff, sub-processors, or other products)?

Answer yes if client data reaches AI or ML models outside of any services provided, for example employees using third-party LLMs, sub-processors applying AI to client data, or other internal systems or products that touch client data. Describe which systems this applies to and what data may be exposed.

18) Is client data exposed to AI outside your direct service discarded and erased once processing is complete?

Answer yes if data processed via these routes is discarded once its processing purpose is complete. Describe the purpose, how long data is retained, and how it's erased, or upload evidence.

19) Is sensitive data (including personal or confidential data) removed, masked, or otherwise prevented from being input into these AI models?

Answer yes if you have controls preventing sensitive client data being processed by these AI tools, such as pre-treating data or technical controls blocking certain inputs. Describe how in the notes section.

20) Is client data exposed to AI outside your direct service used to train AI models?

Answer yes if client data reaching AI or ML models via these routes is used to train or fine-tune those models. Describe which systems this applies to in the notes section.

21) Is client data exposed to AI outside your direct service, and any model trained or fine-tuned using it, kept segregated so that it is not accessible to your other clients or reused by the AI provider or sub-processor beyond what's needed for that specific use?

Answer yes if client data reaching AI or ML models via these routes is segregated from other clients and not accessible to or reused by those AI providers or sub-processors beyond the specific purpose (e.g. not used to train or fine-tune models for other customers). Describe how this is enforced (isolated instances, access controls, contractual restrictions) or upload evidence.

22) Are technical and procedural safeguards implemented to prevent the use of client data within unauthorised AI services that may be considered "shadow AI" (e.g. employees' personal LLM accounts)?

Answer yes if you have controls preventing client data being used in unauthorised AI tools, for example employees pasting it into personal ChatGPT or Claude accounts. Controls can be technical (blocking unauthorised AI domains/apps, DLP rules) or procedural (policy, training). Describe your safeguards in the notes section or upload evidence.

4) Do you have processes in place to ensure your service user evaluates the AI model responses before use?

Answer yes if you have ensured, as far as you are able, that your people (employees, managed contract resources or anyone else acting on behalf of your organisation) have reviewed and evaluated the AI model output before use. These processes should help mitigate the risks arising from inaccuracies or ‘hallucinations’ (plausible created statements) within AI outputs which, if applied without human review, can impact integrity and mislead decision-making. Users should have access to documentation that provides guidance describing the potential AI models’ limitations and considerations to take when reviewing output. Describe how you ensure this human review takes place in all circumstances or upload supporting documentation.

5) Does your organisation use automated decision-making technologies (e.g. Machine Learning models, AI agents) for internal use-cases that can take actions or make decisions without human review?

Answer yes if your organisation uses any automated decision-making technologies for internal use-cases, including Machine Learning models or AI agents, to make decisions or carry out actions without a human reviewing or approving the outcome first. This could include automated approvals or rejections, automated risk scoring, or AI agents taking actions on systems or data on a user's behalf. In the notes section, describe the processes or systems these automated decisions support and the nature of the technology used.

6) Where automated decision-making technologies are used, are technical and/or procedural guardrails implemented to prevent actions that could adversely impact critical systems or services?

Answer yes if guardrails are in place to restrict the automatic implementation of outputs from any automated decision-making technologies (ML, AI agents, etc.), that might have an adverse impact on critical systems or services.

7) Where automated decision-making technologies are used, can system or service configuration decisions be reproduced through testing with identical inputs and do you retain sufficient records to identify any variance in decisions?

Answer yes if you have the capability to review output from automated decision-making technologies (ML, AI agents, etc.), perform testing to reproduce expected outcomes, and retain sufficient records of relevant input and output to support the identification of unexpected or inconsistent results.

9) Has your organisation conducted a regulatory compliance and security risk assessment of how your AI or AI-supported service processes and responds to client data and information?

Answer yes if your organisation has conducted and documented a regulatory compliance and security risk assessment for each AI or AI-supported service you provide. This should consider how the service operates and is secured against requirements such as the EU AI Act or the OWASP Top 10 for LLM, along with output accuracy, bias countermeasures, abuse prevention, and the risk of IP or copyright infringement claims from AI-generated output. Set clear security criteria to test against before deployment, and revisit the assessment periodically using monitoring data and feedback rather than treating it as a one-off exercise. Upload supporting documents evidencing the assessment, or describe it in the notes section.

01) Is your organisation a legally registered entity?

Answer yes if your organisation is a legally registered entity and upload proof of registration (as a PDF file, this is typically a certificate of incorporation) as evidence. Please note the country or jurisdiction in which your company is registered in the notes.

02) Does your organisation have enough working capital to remain viable for the next 12 months?

Answer yes if your organisation has enough working capital to remain for the next 12 months.

03) Does your organisation have 3 years (or more) of published annual accounts?

Answer yes if your organisation has 3 years (or more) worth of published annual accounts. Please upload the last 3 years of accounts as evidence. If your organisation has less than 3 years, please upload any accounts that have been published (as PDF files).

04) Does your organisation have a documented set of policies and procedures for managing compliance with all applicable anti-money laundering (AML) laws and regulations, including anti-terrorism financing laws and regulations, within the jurisdictions that you operate?

Answer yes if your organisation has an established and documented framework for maintaining anti-money laundering compliance with all applicable laws and regulations. Please upload (as a PDF file) a document outlining the framework as evidence.

05) Does your organisation have a documented set of policies and procedures for managing compliance with all applicable anti-bribery and corruption (AB&C) legislation or regulations in the jurisdictions in which you operate?

Answer yes if your organisation has a documented set of policies and procedures for managing compliance with all anti-bribery and corruption (AB&C) legislation or regulation in the jurisdictions you operate.

06) Does your organisation have a policy to manage conflicts of interest relevant to anti-bribery and corruption?

Does your organisation have a policy to manage conflicts of interest relevant to anti-bribery and corruption?

07) Does your organisation provide employees with regular anti-bribery and corruption compliance training, including at onboarding?

Answer yes if your organisation provides AB&C compliance training at regular intervals. Please describe the nature and frequency of the training within the notes.

08) Does your organisation conduct assurance against its third party suppliers, agents, and sub-contractors to ensure that they have a required level of anti-bribery policies and procedures in place?

Answer yes if your organisation conducts supplier assurance to ensure your suppliers have the correct anti-bribery policies and procedures in place.

09) Does your organisation have a documented set of policies and procedures to ensure compliance with financial and trade sanctions?

Answer yes if your organisation has an established and documented set of policies and procedures for monitoring and maintaining compliance with financial sanctions. Please upload your policy and process documents (as PDF files) as evidence.

10) Does your organisation have a compliance officer or equivalent role dedicated to financial crime, including economic and trade sanction compliance?

Answer yes if your organisation has a compliance officer dedicated to maintaining your organisation's compliance with all applicable financial crime regulations, including economic and trade sanctions.

11) Does your organisation conduct ongoing due diligence to ensure your company is not dealing with a sanctioned company or individual?

Answer yes if your organisation conducts ongoing checks to ensure compliance with all applicable economic and trade sanctions.

12) Does your organisation have pre-transaction screening processes that makes use of all applicable economic and trade sanctions lists?

Answer yes if your organisation conducts pre-transaction screening that makes use of all applicable economic and trade sanctions lists. Please list the relevant lists used in the notes.

13) Does your organisation provide employees with regular sanctions training, including at onboarding?

Answer yes if your organisation provides employees with regular sanctions training. Please describe the nature and frequency of the training within the notes.

14) Does your organisation have an established, consistent, and documented framework in place covering the detection, prevention, response to and investigation of suspicious or fraudulent activity?

Answer yes if your organisation has an established and documented framework for detecting, preventing, responding to, and investigating suspicious or fraudulent activity. Please upload (as a PDF file) a document outlining the framework as evidence.

15) Does your organisation have a documented fraud response plan?

Answer yes if your organisation has a documented fraud response plan. The plan should cover your organisation's internal processes and reporting lines for the reporting and investigation of any instances of fraud Please upload the plan (as a PDF file) as evidence.

16) Is financial crime considered at senior management level within your organisation?

Answer yes if your organisation has a member of senior management who is responsible for financial crime or a process for ensuring financial crime risk & treatment action is considered by the senior management team.

17) Does your organisation provide employees with regular fraud prevention training and/or awareness sessions, including at onboarding?

Answer yes if your organisation provides employees with regular fraud prevention training or awareness programmes. Please describe the nature and frequency of the training within the notes.

18) Does your organisation have public liability insurance?

Answer yes if your organisation holds a valid public liability insurance policy. Please provide the certificate of insurance (as a PDF file) as evidence.

19) What is the limit of your organisation's public liability insurance policy (in GBP)?

Please state the limit of the cover in GBP (if in another currency, please convert to GBP).

20) Does your organisation have professional indemnity insurance?

Answer yes if your organisation holds a valid professional indemnity insurance policy. Please provide the certificate of insurance (as a PDF file) as evidence.

21) What is the limit of your organisation's professional indemnity insurance policy (in GBP)?

Please state the limit of the cover in GBP (if in another currency, please convert to GBP).

22) Does your organisation have Employers' Liability insurance?

Answer yes if your organisation holds a valid employers' liability insurance policy. Please provide the certificate of insurance (as a PDF file) as evidence.

23) What is the limit of your organisation's employers' liability insurance policy (in GBP)?

Please state the limit of the cover in GBP (if in another currency, please convert to GBP).

01) Does your organisation have any certifications or audit reports that cover environmental, social or governance issues (such as ISO 14001, ISO 45001 or B Corporation certification)?

Answer yes if your organisation has obtained any certifications or any external audit reports which cover any environmental, social or governance issues. Please state the certification or report in the notes and please upload a PDF of the relevant certification or report as evidence.

02) Does your organisation have a documented Environmental Management policy?

Answer yes if your organisation has a documented environmental management policy that looks to minimise your organisation's impact on the environment. The policy must have undergone senior management review and approval within the last year. Please upload the policy (as a PDF file) as evidence.

03) Does your organisation publicly share metrics related to your Environmental, Social & Corporate Governance?

Answer yes if your organisation publicly shares information and metrics about your environmental and social impact. Please upload a copy of the latest report as evidence or provide a link to it.

04) Does your organisation conduct any activities that might be deemed as hazardous to the environment?

Answer yes if your organisation conducts any activities that could be perceived to be hazardous to the environment. This could include but is not limited to mining, construction, demolition, manufacturing, chemical processing, or fossil fuels. Please describe your business activities in the notes.

05) Has your organisation received any adverse media coverage, legal action, penalties or sanctions for environmental reasons?

Answer yes if your organisation has been subject to any adverse media coverage or legal action relating to environmental concerns or if your organisation has received any penalties or sanctions for environmental reasons. Please include details in the notes.

06) Does your organisation measure its scope 1, scope 2, or scope 3 emissions as per Greenhouse Gas (GHG) Protocol standards?

Answer yes if your organisation measures your scope 1, scope 2, or scope 3 emissions as defined by Greenhouse Gas (GHG) Protocol. If you only measure your scope 1 or 2 emissions, please still answer yes and provide the relevant information in the following questions.

07) What are your scope 1 emissions (tonnes of CO2 equivalent per year)?

Please enter the most recent measurement for your scope 1 emissions in tonnes of CO2 equivalent. Please state when this was last measured and provide further information on the scope and method of measurement, if applicable, in the notes section. If you do not measure scope 1 emissions, please enter zero as your numerical answer and state this clearly in the notes section.

08) What are your scope 2 emissions (tonnes of CO2 equivalent per year)?

Please enter the most recent measurement for your scope 2 emissions in tonnes of CO2 equivalent. Please state when this was last measured and provide further information on the scope and method of measurement, if applicable, in the notes section. If you do not measure scope 2 emissions, please enter zero as your numerical answer and state this clearly in the notes section.

09) What are your scope 3 emissions (tonnes of CO2 equivalent per year)?

Please enter the most recent measurement for your scope 3 emissions in tonnes of CO2 equivalent. Please state when this was last measured and provide further information on the scope and method of measurement, if applicable, in the notes section. If you do not measure scope 3 emissions, please enter zero as your numerical answer and state this clearly in the notes section.

10) Is your organisation working towards a net zero carbon emissions target?

Answer yes if your organisation is proactively working towards achieving net zero carbon emissions. Please attach your Carbon Reduction Plan (or similar) if you have one.

11) When do you expect to achieve net zero carbon emissions?

Please state the year in which you expect your organisation to achieve net zero carbon emissions.

12) Does your organisation have a documented Health & Safety Policy?

Answer yes if your organisation has a documented Health & Safety policy. Please upload the policy (as a PDF file) as evidence.

13) Does your organisation have a senior manager or board member who is responsible for your Health & Safety Programme?

Answer yes if your organisation has an appointed resource that is responsible for the design and delivery of your company's health and safety programme. This is typically a health and safety officer. In the notes, please outline the job role and whether or not this is a dedicated full time position.

14) Does your organisation have an established and consistent framework for Health and Safety which includes provisions to ensure a safe and hygienic working environment for all of your personnel, in accordance with local health and safety laws and industry best practices?

Answer yes if your organisation has implemented a framework for managing health and safety compliance across your company. The framework must include health and safety awareness initiatives (such as posters), a risk assessment programme, a defined and auditable reporting process, and relevant and valid insurance policies (in the UK this is covered by your employers liability insurance). Please describe how you manage Health & Safety in the notes.

15) Does your organisation work to a committed code of business ethics which includes ethical labour practises?

Answer yes if you commit to the standards set out in a publicly recognised code of ethics such as the Ethical Trading Initiative (ETI) Base Code or if your organisation has developed and abides by its own code of ethics covering labour practises. Please give more details in the notes section.

16) Does your organisation ensure compliance with all applicable human rights laws and regulations?

Answer yes if your organisation is fully compliant with all applicable human rights laws and regulations. This may include, but is not limited to, the International Bill of Human Rights, the UK Modern Slavery Act 2015, and the EU working time directive. Please note that these laws and regulations may require further actions from your organisation to ensure compliance. Please describe how you comply in the notes section and upload evidence of relevant policies, processes or compliance documents.

17) Does your organisation have policies and procedures in place that ensure the prevention of modern slavery?

Answer yes if your organisation has policies and accompanying procedures in place to prevent modern slavery in your own organisation and within your supply chains. Relevant policies may include: Supplier code of conduct, Migrant worker policy, Child labour policy, Human rights policy, Recruitment policy, Procurement policy, Employee code of conduct, Policies concerning access to remedy, compensation and justice for victims of modern slavery, Policies that relate to staff training and increasing awareness of modern slavery, Policies that relate to worker wages, welfare and living standards. Please include in the notes details of your policies and procedures and upload the relevant documents (as PDF files) as evidence.

18) Have any incidences of modern slavery been recorded or uncovered within your organisation or supply chains in the past 12 months?

Answer yes if there have been any suspected or confirmed cases of modern slavery within your organisation or within your supply chain in the past 12 months. Please include in the notes details about how the incidences were identified, investigated and what action was taken.

19) Does your organisation provide a grievance mechanism for workers to raise workplace concerns?

Answer yes if your organisation has a mechanism in place (backed up by a written policy document with a defined process) that allows employees and contractors to address grievances relating to their employment. Please upload the policy document (as a PDF file) as evidence.

20) Does your organisation have a documented diversity and inclusion policy?

Answer yes if your organisation has a documented diversity and inclusion policy that outlines the organisation's commitment to providing an inclusive and supportive environment for staff, contractors and visitors that is free from discrimination.

21) Does your organisation provide a confidential method (also known as a whistleblowing procedure) for employees and contract staff to freely report any perceived issues that might impact your clients or their customers?

Answer yes if your organisation has a defined and documented procedure that enables employees and contract staff to report any incidents or perceived issues confidentially. This is typically provided through a confidential phoneline or email address. Please outline the process in the notes section provided, or upload a policy or process document (as a PDF file) as evidence.

22) Does your organisation clearly inform employees and contract staff how to access and utilise the whistleblowing procedure to confidentially report any issues?

Answer yes if your organisation clearly informs all employees and contract staff how to access and utilise the whistleblowing procedure.

23) Does your organisation conduct regular assurance activities against its suppliers to ensure they are operating in line with your own environmental, social and governance policies, including checking that they are compliant with relevant laws and regulations?

Answer yes if your organisation conducts regular (e.g. quarterly, annually) supplier assurance to ensure your suppliers meet the same standards of environmental management, social responsibility, and governance that is expected of your organisation, and that they are compliant with all applicable laws and regulations. Describe the nature and frequency of the assurance activities in the notes.

01) Does your organisation process any client data outside the United Kingdom or European Union?

Answer yes if any client data is processed, stored, or accessed outside the United Kingdom or countries belonging to the European Union. If yes, state the countries where data is processed and outline any additional safeguards in place (e.g. adequacy decisions, SCCs, certifications) in the notes.

02) Will your organisation access information classified as OFFICIAL-SENSITIVE or higher?

Answer yes if your organisation will process or access information classified as OFFICIAL-SENSITIVE or higher.

03) Do you apply the HMG Baseline Personnel Security Standard (BPSS), or equivalent, for all individuals working with or on behalf of UK Government?

Answer yes if all staff working with or for the UK Government meet BPSS (or equivalent). Provide details of your pre-employment checks in the notes and upload a template or policy document as evidence if available.

04) Has your organisation signed up to the UK Software Security Code of Practice?

Answer yes if your organisation conforms to the UK Software Security Code of Practice. State in the notes section whether your organisation has signed up as a Software Security Ambassador or is otherwise a signatory, and describe your progress against the Code's principles. Upload any self-assessment documentation as evidence.

05) Has your organisation obtained the Defence Cyber Certification (DCC)?

Answer yes if your organisation holds a current, valid Defence Cyber Certification (DCC), the UK Ministry of Defence's cyber security certification scheme for defence suppliers. Upload your DCC certificate as evidence and state the certification level achieved (Level 0, 1, 2 or 3) in the notes section.

01) Have you completed an NHS Data Security and Protection Toolkit (DSPT) self-assessment?

Answer yes if your organisation has completed a Data Security and Protection Toolkit self-assessment. All organisations that have access to NHS patient data and systems must use this toolkit.

03) Has your organisation formally declared their commitment to the NHS Cyber Security Charter?

The charter sets out the cyber security standards expected of NHS IT suppliers. Suppliers can commit to it via the NHS England website. Answer yes if your organisation has signed up, and upload your certificate as evidence.

*****Only if Yes to XD1***** 2) What is your current DSPT standard?

Please upload evidence and add ODS code in the notes section.

01) Do you maintain certifications or align your OT security practices with recognised standards or frameworks such as IEC 62443, ISO 27001, or the NCSC CAF?

Answer yes if your organisation maintains any certifications or aligns with best practices regarding OT security practices. Provide any relevant documentation, such as certificates, as evidence.

02) Do you have documented OT security policies that define roles, responsibilities, and acceptable use guidelines applicable to the OT products or services you provide?

Answer yes if your organisation has a documented OT Security Policy. This may be a separate policy or a distinct section within your Cybersecurity or Information Security Policies. Upload the policy as evidence.

03) Do you provide mandated OT/ICS-specific security awareness training for personnel involved in the design, build, or maintenance of OT systems?

Answer yes if your organisation provides security awareness training scoped specifically for OT and ICS. This may be separate from your corporate IT security awareness training and should cover the unique security considerations of OT systems.

04) Do you maintain an up-to-date inventory of all OT hardware and software assets (e.g., PLCs, RTUs, SCADA servers) that are within the scope of products/services you provide?

Answer yes if your organisation keeps an up-to-date inventory of all OT hardware and software assets, listing asset owners and details such as version numbers, business usage, and location. Include details in the notes.

05) Do you maintain documentation, such as network diagrams, describing how your OT systems are segregated from enterprise IT networks (e.g., via firewalls or DMZs)?

Answer yes if you have documentation that clearly describes how environments providing OT support are segregated from your enterprise IT networks. Upload supporting documentation as evidence.

06) Are engineering workstations, configuration tools, or privileged devices managed separately from standard enterprise user devices and restricted from performing unnecessary enterprise tasks (e.g., general web browsing/email)?

Answer yes if technical or procedural controls ensure OT-specific devices are managed separately from enterprise user devices and restricted from standard enterprise activities where appropriate.

07) Do you maintain a list of software and firmware dependencies, such as a Software Bill of Materials (SBOM), for the OT systems you provide?

Answer yes if your organisation maintains an inventory of software, firmware, and other dependencies (e.g. an SBOM or equivalent) for the OT systems, products, or services you provide. Describe how dependencies are identified, maintained, and reviewed in the notes. Upload supporting documentation as evidence.

08) Is all remote access to the OT environment protected through secure, managed, and monitored access controls, and are privileged OT accounts uniquely assigned to individuals and separate from their standard enterprise accounts?

Answer yes if all remote access to OT systems is controlled through secure access technologies and formal access management processes, such as MFA, PAM, or jump hosts. Accounts used for OT remote access must be uniquely assigned to individuals and separate from standard enterprise accounts. Describe the controls in place, including any exceptions, in the notes. Upload supporting documentation as evidence.

09) Do you test security patches in a segregated or separate test network for applicability and stability before recommending or applying them to the client's production environment?

Answer yes if your organisation tests security patches, firmware updates, and other changes in a representative non-production environment before deployment, assessing compatibility, stability, operational impact, and safety. Describe the testing and approval process in the notes. Upload supporting documentation as evidence.

10) Do you conduct regular, OT-specific vulnerability assessments or threat modelling for the systems under your management?

Answer yes if your organisation performs periodic vulnerability assessments, threat modelling, or equivalent security reviews designed for OT environments, accounting for their unique operational, safety, availability, and legacy technology requirements. Describe the frequency, methodology, and scope in the notes or upload supporting documentation as evidence.

11) Do you have a documented incident response playbook specifically for OT environments, including defined recovery actions?

Answer yes if your organisation maintains documented incident response procedures specifically covering OT environments, defining roles and responsibilities, escalation, containment, recovery actions, and coordination requirements. Describe the scope in the notes or upload supporting documentation as evidence.

12) Have OT-focused incident response exercises, tabletop scenarios, or recovery tests been conducted in the last 12 months?

Answer yes if your organisation has conducted OT-specific incident response exercises, tabletop scenarios, or recovery testing in the last 12 months, covering detection, response, and recovery for OT systems. Summarise the testing performed and key lessons learned in the notes or upload supporting documentation as evidence.

13) Are OT configurations (PLC logic, SCADA settings, etc.) regularly backed up, stored securely away from the production network, and tested for restorability?

Answer yes if your organisation regularly backs up critical OT configurations and data (e.g. PLC logic, SCADA settings), stores backups securely and separately from production, and periodically tests restoration. Describe the backup and restoration testing processes in the notes or upload supporting documentation as evidence.

01) Does your organisation have a documented policy aligned to the principles of the FCA's Treating Customers Fairly (TCF) initiative and Consumer Duty requirements?

Answer yes if your organisation maintains a documented policy that has been reviewed within the last 12 months and aligns to TCF principles and Consumer Duty obligations. The policy should outline how good customer outcomes are defined, delivered, and monitored in practice. Provide the policy (as a PDF file) and evidence of how its effectiveness is assessed.

02) Does this policy include specific guidelines or procedures for the fair treatment of vulnerable customers?

Answer yes if the policy includes defined processes to identify, support, and monitor vulnerable customers, and how outcomes for these customers are assessed. Provide evidence or reference relevant sections.

03) Does this policy include guidelines or procedures for complaints handling and the identification of potential customer harm?

Answer yes if this policy contains guidelines or procedures on handling customer complaints. This may include guidelines or procedures to ensure customer complaints are accurately recorded, reviewed, and addressed accordingly. Provide this policy (as a PDF file) as evidence or reference a section of a previously provided policy.

04) Does this policy include remuneration and incentive controls designed to prevent unfair customer outcomes?

Answer yes if this policy contains guidelines or procedures to ensure effective controls are in place to manage any risks that remuneration may have on unfair outcomes. This may also include any rewards or incentives that may promote good customer outcomes. Provide this policy (as a PDF file) as evidence or reference a section of a previously provided policy.

05) Does your organisation provide regular training on TCF and Consumer Duty, including at onboarding?

Answer yes if your organisation conducts regular training on Treating Customers Fairly and Consumer Duty. Outline the nature and frequency of the training programme in the notes section, including details on how employees' knowledge is assessed, the frequency at which training is updated, and how effectiveness is measured.

06) Does your organisation have a senior leader accountable for Consumer Duty and customer outcomes?

Answer yes if your organisation has designated a senior leader responsible for Treating Customers Fairly and Consumer Duty. In the notes section provide additional details on your governance structure, including the extent to which the conduct culture set by the board promotes good customer outcomes, and whether there is a senior leader who is ultimately accountable.

07) Does your organisation define what constitutes good customer outcomes for its services, and identify, assess, and manage the risks that could prevent customers from receiving them?

Answer yes if good customer outcomes are clearly defined and documented for the products or services provided, and there are defined processes to identify, assess, monitor, and manage risks that could prevent customers from receiving those outcomes. Describe how good customer outcomes are defined and how customer outcome risks are identified, monitored, and managed.

08) Are customer outcome or conduct risk issues reported to senior leadership?

Answer yes if outcome or conduct risk issues are reported to senior leadership. If yes, specify when and describe the nature of reporting in the notes (e.g. MI, dashboards, escalation reports).

09) Does your organisation collect management information related to customer outcomes and complaints?

Answer yes if your organisation has systems and processes in place to collect management information related to customer outcomes and complaints. In the notes section describe these systems and processes along with the type of data being collected.

10) Does your organisation analyse management information, complaints, and customer outcomes data to identify trends or risks of poor outcomes, and use these insights to improve policies, processes, controls, and services?

Answer yes if there are defined processes to analyse management information, complaints, and customer outcomes data to identify trends, risks, or indicators of poor customer outcomes, and insights from this analysis are used to improve policies, processes, controls, products, or services. Provide details of the analysis performed and how insights are used to drive improvements.

11) Does your organisation have controls in place to ensure that all customer communications are clear, fair, not misleading, and appropriate for the intended audience?

Answer yes if your organisation has documented controls to ensure customer communications meet regulatory expectations (e.g. clarity, fairness, and not misleading). Controls should include review, approval, and quality assurance processes to validate communications before being issued. Provide evidence where applicable.

12) Does your organisation assess and validate whether customers understand the information provided through testing, feedback, or monitoring?

Answer yes if processes are in place to evaluate and confirm customer understanding using defined methods (e.g. surveys, call monitoring, behavioural analysis, or customer feedback). Provide evidence where applicable.

14) Does your organisation monitor customer outcomes across the end-to-end customer journey (e.g. onboarding, servicing, and exit)?

Answer yes if outcomes are monitored across all stages of the customer lifecycle with controls in place to identify risks. Provide evidence where applicable.

15) Does your organisation ensure customers can access timely and effective support throughout the service lifecycle?

Answer yes if accessible support channels are available and monitored for effectiveness.

16) Does your organisation monitor the effectiveness and accessibility of its customer support channels?

Answer yes if metrics such as response times, resolution rates, and customer feedback are tracked and reviewed.

17) Does your organisation hold ISO 9001 (Quality Management) or an equivalent certification?

Answer yes if a valid certification is in place demonstrating a structured quality management framework.

Does your organisation ensure that the services provided are designed to meet the needs of the intended customer group?

Answer yes if services are designed and periodically reviewed to ensure they meet the needs of defined customer segments.

Security Governance

Understand your supply chain.Defend-as-One.

Understand your supply chain.
Defend-as-One.