AirCyber is the AeroSpace and Defense official standard for Cybersecurity maturity evaluation and increase built by Airbus, Dassault Aviation, Safran and Thales to help the AeroSpace SupplyChain to be more resilient. Their joint venture BoostAeroSpace is offering this extract of the AirCyber maturity level matrix to provide further details on this standard, the questions and the AirCyber maturity levels they are associated to. AirCyber program uses this maturity level matrix as the base of the cyber maturity evaluation as is the evaluation activity is the very starting point for any cyber maturity progression. Being aware of the problems is the mandatory very first knowledge a company shall know to decide to launch a cybersecurity company program. Source: https://boostaerospace.com/aircyber/
Showing 221 controls
Manage Wi-Fi access segregated
Do you have a secure Wifi access with a separation of uses? (staff, industrial, professional, visitor, etc.)
Detect any new device connected to the network.
Do you allow connection to the network only to devices identified and man-aged by the information system?
Secure exchange platform access with suppliers and subcontractors to exchange sensitive data
Do you offer a secure exchange platform for your subcontractors and suppli-ers?
Strong identification on critical services with alerts
Do you use strong authentication and monitor (alerts in case of failure) the connection to sensitive devices such as: IT device administration, cloud ser-vices administration and websites?
Active Directory complete hardening and associated security alerts
Have you finished the security hardening of your active directory server (by applying all best practices or having accepted the residual risks of undeployed measures) and have you configured the gener...
AD hardening and logging
Do you secure the default configuration of your Active Directory (AD) server and do you keep at least for a year the logs with the authentication information on the AD? (hardening of the operating sys...
Administrative rights needed to install software
Do users need administrative rights that require different authentication with an admin account or computer support to install software on their computers?
Antivirus central update console
Do you use a centralized management system to update and manage solutions against malicious software/code? [Industrial IT] [Corporate IT]
Antivirus testing
Do you test the effectiveness of malware protection programs? [Industrial IT] [Corporate IT]
Antivirus update
Do you have a policy for antivirus signatures and engine update, on a weekly basis minimum for all standard devices, with exception management for specific devices? [Industrial IT] [Corporate IT]
Archives restricted access
Is access to the archives restricted or protected using physical access control (keys, badges...)? [Industrial IT]
attacks or malicious activities detection (e.g. SOC)
Is there a Security Operation Center (SOC) for detecting issues and monitoring the cybersecurity of the information system?
Automatic and managed back-up / restore process & test
Do you define and apply an automatic backup policy for critical components with a tested recovery procedure?
Automatic encryption of data classified as confidential when sent outside company (e-mail, USB key…)
Do you have a solution to prevent the sending of unprotected confidential data or to systematically encrypt it before it is saved or sent outside your infor-mation system?
Automatic HW inventory tool centralized
Do you have an up-to-date inventory of your IT system? (servers, desktop PCs, laptops, printers, network devices, smartphones, etc.) Do you have an accurate and up-to-date inventory of the assets (wor...
Automatic HW inventory tool centralized and new device detection.
Have you implemented a detection and monitoring solution (NAC, DHCP moni-toring) for the connection of new devices (PC, server, printer, routers, Internet modems…) on your internal network?
Automatic vulnerability detection plus threat intelligence regarding cyber threat, attacks and vulnerabilities from all sources
Have you set up or contracted professional and customized security alert services for your company, its sector of activity, the IT devices you have deployed, etc. (professional or sectoral "CERT")?
Backup review
Are the backup devices subject to regular checks to ensure that they are working properly? [Industrial IT] [Corporate IT] [Development Environment]
Best practice for removable media.
Have you defined rules concerning the behaviour of users regarding the de-vices they could connect to their computers (prohibit to connect a USB flash drive found by chance, do an antivirus scan of th...
Business Continuity Plan
Do you have a business continuity plan describing the processes and technologies in place to recover from any incident on critical servers, network equipments, laptops and desktops? [Corporate IT]
Central mobile device applications management and control list of application deployed by users.
Are enterprise smartphones managed centrally with a tool to control their configuration, security status?
Central Network cyber incidents monitoring
Is there a Network Operations Center (NOC) or similar solution for detecting network security incidents?
centralize logs interpretation in SIEM
Do you centralize security incidents and events through events collection tools (SIEM (Security Information Event Management))?
Centralized secure log collection system from the different ICT sensitive sources
Do you use a centralized solution to activate, keep for at least a year and configure the logs of the most important components like firewalls or internet access?
Centralized smartphone management [MDM]
Do you use a tool to ensure that all your smartphones are secure in a con-sistent way (identical security policies between them, gap management, etc.)
Centralized, monitored active management of users (Active Directory) with security alerts
Do you have a centralized and secure management of user accounts capable of detecting abnormal behavior (theft of identifiers, use on non-standard servers, attempt to discover the password...)?
CERT : Stay aware of cyberenvironment [CERT alert by ANSSI] / follow news from SW editors
Do you follow at least every week a procedure of management of security alerts and advisories of CERTs (Computer Emergency Response Teams) and software editors?
Change default ID and password for devices and services
Do you change the default passwords and identifiers of the devices of your in-formation system?
Clean office policy
Do you have a clean desktop policy (physical and screen lock) for sensitive papers and removable storage media?
Code security tools
Do you use tools to perform code security checks (e.g. Static or Dynamic Application Security Testing)? [Product] [Development Environment]
Common guideline/policy for the data classification in place
Did you defined a data classification policy according to its use (public, confi-dential company, confidential...) and the protection rules to be applied to this data?
Communicate to all employees' company security policy and directives
Has your organization implemented an Information Security Policy and associated controls? Do you communicate them to all users and project managers?
Continuous risk assessment with central tool generating KPI presented to management level
Do you have a computer-based risk management solution that allows you to raise the level of cyber risk and process it in a more or less automated way ?
Control ICS mainframe connections
Do you have the means to detect foreign or unauthorized connections to the servers used by your industrial systems in order to qualify and block them if necessary? [Industrial IT]
Control internet/network sharing/merging in devices (usb modem, etc)
Do you have protection on the workstations to prevent users from opening unsecured Internet networks by connecting for example a modem / 3G USB flash drive, smartphone and at the same time having thes...
Crisis management exercices
Do you perform crisis management training/simulation sessions? [Industrial IT] [Corporate IT]
Customers data backup policy
Does your backup policy take into account the data and products provided to your customers? [Industrial IT]
Customers data location & connections
Are you able to list the physical production sites included in the services provided to your customers? Do you have an up-to-date diagram showing the network interconnections between your customers an...
Customers data protection directive implemented
Do you process data sent by your customers or created in the frame of the project in accordance with the latest version of your customers Protection of Information directive? [Product]
Customers policy to suppliers
Do you contractually cascade your customers security requirements on your suppliers and third-party partners so they can implement the appropriate measures to meet the project security requirements? [...
Customers project data control
Do you identify the location of your customers data / assets that are processed / operated in the frame of the project (including if relevant your customer's personal data), in particular when they ar...
Customers security channel
Do you have the contact details of your customers' points of contact to alert in the event of a security incident and vice versa contact points are transmitted to your customers in order to respond in...
Cyber Certification
Has your organization implemented a set of security guidelines, procedural instructions or processes based on a security standard framework (ISO27001, NIST,….)? If yes, which framework do you use? [C...
Cyber Dev Standard
Are developers systematically trained on best secure development practices based on a standard ? [Product] [Development Environment]
Cyber security certification
Is your organization certified in security? If yes, please provide certificate, and information on certification scope. [Industrial IT] [Corporate IT] [Development Environment]
Data handling rules
Do you set up security measures adapted to the level of classification of the data handled on the media (Laptop, USB, email, ...)? [Industrial IT] [Corporate IT]
data lost prevention solutions with central management of data confidentiality solutions
Do you implement enterprise data protection management solutions (leak de-tection of confidential data, roles and responsibilities, etc.)?
Data regulation policy
Do you identify the type of data you manipulate in order to process them accordingly: - personal data - country regulated data - export control data - business sensitive data - other types of data (pl...
Data sensitivity in ICS
Do you take into account, in the industrial environment, the sensitivity of the information exchanged with your customers? [Industrial IT]
Data tagging and data labelling
Have you implemented a solution to automatically classify your company's data, or to help users making a decision to protect data that would be classified as sensitive?
Dedicated and compartmentalized network for information system administration
Do you use a dedicated, segregated network (internet, user workstation) secured by protocol break (bouncing machine, bastion host, reverse proxy, etc.) for the administration of the information system...
Define and apply a backup policy for sensitive data
Is the important data saved regularly?
Detect / block unauthorized connection to network
Do you block unauthorized connections to your network?
Dev Cloud customer data segregation
Do you use cloud environments to store and process your customers or production data? If yes, do you segregate data by customers logically at least in all environments (production, backup...)? [Devel...
Dev env. Virus scan
Do you perform antivirus or anti-malware checks on the code repositories in order to ensure the lack of malicious code? [Development Environment]
Dev env. Vulnerabilities monitoring
During the development phase, do you have an active vulnerability assessment process in order to control the development environments and ensure the lack of known vulnerabilities in the framework (ope...
Dev settings backups
Do you perform a regular configuration backup in order to restore the environments in case of a security incident? [Development Environment]
Dev, Products components inventory
At each project start, do you have a process to identify and validate the firmware versions and the hardware COTS, in order to ensure that these items used in the product and the development environme...
Dev, Products Customers projects standard
Has a Project Security Management Plan been developed, implemented and communicated to your customers to ensure that all stakeholders understand the project expectations and their roles and responsibi...
Dev, Products libraries vulnerabilities identification
At each project start, do you have a process to identify and validate the software or libraries versions, in order to ensure that these software and libraries used in the product and the development e...
Dev. Cyber languages guide
Do you have a secure code guideline or standard for each development language that is used by your developers? [Product] [Development Environment]
Dev. Security infrastructure
Did you deploy security components on your customers development environments in order to ensure the security: - Defence in depth equipment (IDS, IPS) - Privilege Access Management (PAM) - Monitoring...
Devices destruction process
Do you implement decommissioning processes (disposal report, total deletion of files) before the disposal of assets (workstations, servers)? [Industrial IT] [Corporate IT]
Disable USB autorun
Do you disable autoruns on new plugged devices on computers, laptops and servers ? [Industrial IT] [Corporate IT]
Encrypt / protect sensitive data sent outside the company (e-mail, USB exchanges…)
Have you deployed means and tools allowing users to encrypt sensitive data sent outside of the company?
Encrypt data on mobile devices (USB drives, smartphones)
Do you encrypt sensitive data on removable media without any user interac-tion (transparent automatic encryption)?
Encrypt email content easily
Do you offer users the possibility to easily encrypt the content of e-mails?
Encrypt passwords
Do you protect passwords stored on systems (encryption)?
Encryption for internet links between different sites
Do you encrypt your connections between your various sites of your company and your partners?
Ending date for users account
Do you always set an end date when creating trainee or external (providers) accounts? [Industrial IT] [Corporate IT] [Development Environment]
Escalation and alerting process with Security hotline
Have you implemented, documented and tested, at least once a year, a security problem management procedure to ensure that you can react quickly and in-volve the right internal or external people?
Firewall on laptop and desktop
Do you use a firewall on client workstations? (laptop, desktop PC)?
Forbid or securely manage "BYOD"
Have all devices (computer, tablet pc, smartphone) connected to the compa-ny's information system been subject to a formal and prior approval proce-dure?
Governance model (roles and responsibilities / data owner)
Have you defined that your company's data should be associated with identified managers and their responsibilities (HR data, design office data, etc.)
Hard Disk encryption on desktops
Do you encrypt computer, smartphones hard disks without any user interaction (transparent automatic encryption)?
Hardening of products
At each project start, do you perform configuration hardening of the development environments including for instance the deactivation of unnecessary unused components, ports, protocols or functions? [...
Have an awareness process / track awareness deployment to operational security team
Do you train operational teams (network administrators, security and systems administrators, project managers, developers, CISOs) in information systems security?
ICS : dedicated and compartmentalized network for the administration
Do you use a dedicated and partitioned network for the administration of ICS?
ICS : documentation for design, components and operation
Is the documentation relating to the design, components and operation of ICS stored with an appropriate level of security?
ICS : mapping of the company network
Are the documentation, nomenclature and diagrams of ICS devices kept up to date?
ICS : process for monitoring threats and vulnerabilities
Are ICS components subject to a threat and vulnerability monitoring process?
ICS : Setup distinct physical sites for backup storage
Do you regularly verify that the backup of your industrial control systems can be restored without problems?
ICS : specific backup for critical device of industrial control systems
Do you perform backup of your most sensitive industrial control systems (con-figuration, source code and data)?
ICS : documented crisis management process ?
Is there a documented crisis management process? (such as, for example, disas-ter recovery after a system crash)
ICS : Have active monitoring of the IACS (SOC, NOC...)
Do you use a security monitoring centre (SOC, NOC (Network Operations Centre), backup status...) of your network allowing detection of security incidents, back up issues and/or active monitoring of I...
ICS : Identify most critical device on the industrial network
Have you performed an inventory of your industrial control system devices, identifying the most critical components?
ICS : Secure industrial network & devices access from company network
Is there a specifically defined architecture and management rules?
ICS : Set IT specific standard & governance
Is there a qualified person or department dedicated to the design, operation, and monitoring of ICS device?
ICS : specific patch management
Are there procedures in place to manage the life cycle of ICS ?
ICS availability limit
Did you identify and define the maximum tolerable delay of interruption of your production in relation to your customers contracts? [Industrial IT]
ICS backup room security
Is physical access to the storage room of the backups controlled (where applicable)? [Industrial IT]
ICS BYOD policy
Did you implement security measures to manage and secure the use of BYOD in your customers production environments (including network connection, anti-malware protection...)? [Industrial IT]
ICS charter for suppliers
Is the Charter signed by all internal or external users involved in production environments? Do you archive these documents? [Industrial IT]
ICS Customers Servers ID
Are you able to identify the server rooms used as part of each customers' service delivery? [Industrial IT]
ICS Cyber focal point
Is a cybersecurity referent (focal point) identified for the production means? [Industrial IT]
ICS cyber risk analysis
Did you perform a cyber risk analysis on your production information systems? [Industrial IT]
ICS Cyber risk annual review
Do you update (at least once a year) risks identified on your production information systems? [Industrial IT]
ICS default password update
Do you change the default passwords and credentials on your customers production environments? [Industrial IT]
ICS network segregation
Do you implement segregation between the production environment and other environments (qualification, preproduction, company information system, etc.)?
ICS PCA update with Risks
Are risks identified during the risks analysis taken into account in the company's BCP risk? [Industrial IT]
ICS privileges accounts policy
Did you implement security measures governing the use of privileged accounts (creation, modification, deletion, specific rules in case of generic account usage)? If yes, please detail. [Industrial IT]
ICS production customers incident process
Do you have a crisis/incident management process for your customers' production incidents that is shared with your customers? (Notification to your customer Security Manager) [Industrial IT]
ICS removables policy
Do you implement specifics restrictions or measures for the use of removable devices in production environments? [Industrial IT]
ICS secure Radio-Air networks
Is the production wifi network dedicated and isolated from other wifi networks? [Industrial IT]
ICS security audits
Do you perform regular audits (compliance and/or technical) on your supply chain connected to your information system or when regular equipment/material exchange occur? If yes, please precise the fre...
ICS security rules & awareness
Did you define security rules to be applied to production environments and trained the appropriate employees? [Industrial IT]
ICS shared accounts strong authent
If shared accounts are used on production environments, do you implement security measures other than a password to log in to production environments (physical access control to the room hosting the p...
ICS specific PCA
Do you have an IT contingency plan for production environments including machines and production benches? [Industrial IT]
ICS Update
Do you perform production equipment updates at least twice a year? [Industrial IT]
ICS USB storage cleaning
Do you use sheep dip accessible to all users to ensure the safety of removable media used for your customers production? [Industrial IT]
ICS users' identification
Do you have the technical or process means to identify the author of an action on the production environments (authentication logs, correlation between shift planning and accounts used)? [Industrial I...
ICS wireless hardening
Do you disable wifi/wireless connections on equipment (industrial production benches) by default ? [Industrial IT]
ICS workstations update
Are production workstations regularly updated? [Industrial IT]
Identify and Access update for customers connexion
When you request a remote access to your customers' Information System for your employees: do you systematically inform your customers when access must be revoked (e.g. when an employee left your comp...
Identify the company's most sensitive servers
Do you know the most sensitive servers in your information system?
Implement hosts IDS/IPS probes on servers and clients to monitors network or system activities for malicious activities or policy violation.
Have you implemented solutions on PCs and Servers to detect, block or alert abnormal behaviors (IDS/IPS)?
Incident management process
Do you have an incident management process (including data breaches incident management) which includes the notification of customers when an incident implies product or services provided to them? [Pr...
Individual identification to all users
Does each employee have a nominative identifier on IT production environments?
Industrial data flows map
vible ? EN: Do you have a standard block diagram showing the cycle of the various exchanges (material and immaterial) between your customers and you for product manufacturing, including internal excha...
Industrial IT : Audit the change processes, and dedicated IACS solutions
Are ICS change processes and dedicated solutions audited annually?
Industrial IT : Make users sign a charter of good conduct
Do users, operators and administrators of Industrial Automation and Control Systems (IACS) signed cybersecurity best practices and charter?
Industrial IT : Have an IACS security awareness or training program for employees and sub-contractors
Is there an ICS security awareness or training program for employees and contractors?
Insurance for cyber events
Do you have an insurance contract covering the consequences of an incident such as: - physical damages - IT damages - cyber damages - business loss [Industrial IT] [Corporate IT]
internal firewalls, physical network segmentation to segregate network
Do you use security device to protect and partition your internal network? (Firewall, proxy, etc.)?
Internet access filtered (blacklist / categorized)
Are Internet accesses filtered by a proxy server?
Internet traffic level NW monitoring with alerting
Is there Internet traffic monitoring with alerts but also indicators (KPIs) on the use of company data on the Internet?
inventory log sources on ICT sensitive systems
Do you use a procedure to implement log backup of the most important com-ponents such as firewalls, internet access?
inventory of allowed and forbidden software
Do you have a list of authorized and prohibited software?
Inventory of HW devices updated frequently
Is the list of your computer devices regularly updated? (servers, desktop PCs, laptops, printers, network device, smartphones, etc.)
Investigate after a security incident related to the industrial IT
When an incident occurs in the production, do you investigate whether it could be caused by a malicious element?
IT cartography
Cartography : Are Physical devices, Software platforms, systems within the organization inventoried and categorized? Do you have a complete cartography of the interfaces of the product with other syst...
Least privilege dev. Env.
Do you grant access to the development environments in accordance with the least privilege principle (to not provide access to all environments to all users but to use a configuration with user groups...
Light smartphones management : configuration of passwords, anti-virus on open systems like Android
Are enterprise smartphones managed by your IT team (for example: password and anti-virus policy configuration)?
Light smartphones security policy
Do enterprise smartphones have a dedicated security policy?
Limit code execution or propagation of malware / virus, automatic scan of removable devices
Do you protect yourselves from threats related to the use of removable media (specific security tool, antivirus configuration for USB, hardening computer)?
Link awareness to HR and offer awareness sessions to new entrants (including trainees) as soon as they are hired / Link yearly objectives to Cyber Awareness.
Do you set up systematic cybersecurity training for all employees and contractors, adapted or customized according to their role in the company, and do you follow up attendance to this training?
Live / automatic update of the company network map
Is your network diagram automatically updated with network information and service protocols?
Log analysis tool allowing forensics
Do you perform log analysis (e.g. real time analysis, SOC, etc.) of the most important components (servers, workstations, laptops, printers, network equipment, smartphones, etc.)?
logs check for admin accounts usage
Do you activate, keep for at least a year and configure the administrator au-thentication logs on network, the server and computer device?
logs for ICS systems & antivirus
Are systems and antivirus logs enabled on production environments? [Industrial IT]
Logs generation on device
Do you activate security log recording on your equipment? [Corporate IT]
Malware protection based on signature list detection
Do you implement an automatic malware detection tool across the entire IT infrastructure (workstations, servers)?
Malware protection detecting abnormal behaviour based on system events
Have you implemented an automatic malware removal or quarantine tool (anti-malware) on the entire IT device?
Manage WI-Fi Guest access segregated
Do you have a "visitor" Wifi isolated from the rest of the Company's network? (Specific connection, dedicated Wifi?)
Management of entry/exit of IT of all users
Is there an entry and exit procedure for users and administrators? (Creation of a specific identifier, signature of a user charter, account deactivation)?
Map of the company network
Do you have a complete network diagram of your company?
Monitor and alert on user device activity
Do you monitor users' devices such as fixed PC, laptop, smartphone, USB key, etc...?
Network traffic abnormal behaviour monitoring
Have you deployed and monitor network probes to detect malicious or abnormal activities?
No admin rights on computers, servers, etc. with day to day user account
Do you confirm that accounts delivered to users for day to day access to the information system (computer, server, cloud) do not have administrative rights (administrators can change security setting...
Offer SSO for netw application or E-SSO password manager
Do you use SSO (single sign on) features for http or applications with an auto-mated password manager and auto fill?
Only Corporate Internet
Do you only use the internet access defined within the company? [Corporate IT]
Operating Systems update management
Do you update your systems as recommended by the editors (update, configuration...) ? [Industrial IT] [Corporate IT] [Development Environment]
Optimize firewall rules management with regular audits
Do you regularly check the rules of your Firewalls?
Password security rules
Is there a password management policy (regular change, minimum security constraints, special characters, number of characters, adapted policy for administrators, etc.)?
Penetration testing for validating IT solutions security, unscheduled penetration testing, technical studies
Do you carry out regular pentest on your IS and your subsidiaries, then apply the associated corrective actions?
PENTEST of company website. Deploy corrective solutions
Do you perform pentest on your company's websites and then apply the associ-ated corrective actions?
Platform 4 Customers Data exchange
Do you use a secure platform to exchange sensitive information with your customers? [Corporate IT]
Policy for external connection to information system
For remote access to your information system (mobile or on-call users, remote sites) do you systematically implement a security solution that ensures strong identification and authentication of the u...
Policy management for all PCs/Laptops. Standardized client setup.
Do you use a tool to ensure that all your workstations (servers, laptops, desk-top PCs) are secure in a consistent way (identical security policies between workstations, gap management, etc.)
Proceed to regular controls of the SI and set corrective solution
Do you carry out regular security audits (application, network, process), then apply the associated corrective actions?
Process for cyber incidents management & escalation
Are there escalation and alert processes for security incidents?
Prod, Dev cybersecurity certification
Does your development process include cyber activities permitting to achieve product cyber certification when it is necessary? Please detail corresponding cyber certifications which can be achieved t...
Product changes approval
After deployment, do you approve changes on the product based on the same security activities defined in the Project Security Management Plan? [Product]
Product, Dev code audit
In order to verify secure code and design rules implementation, do you systematically perform a code audit, at least at the end of the product development, and do you ensure that correctives measures...
Products clean check
Do you perform malware and vulnerability checks before delivery (initial or update)? [Product]
Products code integrity verification
During the delivery phase, are you able to perform tests (hashing function, signature) to ensure software's integrity or authenticity included in the developped solution? [Product]
Products data storage security
Before the delivery phase, do you inspect and sanitize storage media and materials before their use, to ensure that they are free of malicious code? Once inspection is carried out, do you store stora...
Products hardening policy
Do you include hardening principles to reduce the attack surface? [Product]
Products integrity process
In case of suspicion of an altered product, do you have the capability to perform forensics in order to identify the way the software has been tampered with? [Product]
Products logs
Do you have a default logging policy for products delivered to customers that records key product actions? [Product]
Products pen test
Do you perform a penetration test on products before releasing them to your customers? [Product]
Products risk analysis
Do you have a Security By Design policy involving a systematic review of the applicability of a risk analysis carried out on products/services prior to their delivery to your customers in order to ide...
Products security testing
In order to ensure the implementation of secure code and design rules, are security tests performed as a minimum before delivery and/or throughout the product development cycle? [Product]
projects to guarantee that the SIEM and SOC are optimized
Do you regularly check and update your cyberattack detection capabilities? (for example, updating security supervision rules following the pentest performed on your systems, or security project manage...
Propose user awareness (e-mails, information system GTC, documentations…)
Do you make users aware of the rules, good behavior and information security instructions governing daily activity? Is this confirmed by the signing of an information systems charter specifying the r...
Public Dev storage policy
If you store your developments code in public collaborative sharing spaces (GITHUB, cloud services, etc.), do you have a development storage policy that makes it possible for example to identify when...
Redundancy of the power supply
Do you use inverters or back-up batteries (to ensure the power supply in case of loss of power)?
Register to CERT S/W vulnerability and linked to patch follow up
Have you subscribed to a news feed informing you of new cyber security vulner-abilities and cyber security alerts such as those proposed by government CERTs (ANSSI FR, NIST US), international security...
Regular PCA review
Is the business continuity plan (BCP) reviewed and tested regularly? [Corporate IT]
RGPD respect for customers data
In the event your product or service process your customer's personal data, do you ensure that you comply with GDPR regulation (data location, data retention, mechanisms ensuring access/modification/d...
Risk management process (reviewed yearly)
Do you annually review your company's cyber risk level by reviewing your com-pany's risk analyses?
Rules to update frequently SW and systems.
Do you regularly update components (servers, desktop PCs, laptops, printers, network device, smartphones, etc.)?
Save Logs Oustide
Do you outsource cybersecurity logs (outside the environment where they are generated) to ensure their integrity? [Corporate IT]
Secure access to building
Are access to your buildings, offices and IT facilities controlled and limited (e. g. through the use of locked doors, magnetic card readers, prevention, detection and intervention devices in the even...
Secure access to building (servers & technical room)
Is the enclosure of your premises secured by guards with night surveillance, an entrance barrier, video surveillance and an alarm?
Secure access to servers & technical room
Is the enclosure of buildings hosting your server rooms and technical rooms secured by a fence, an entrance barrier, video surveillance, and an alarm?
Secure admin accounts management solution
If you use administrator accounts on machines, do you have a solution in place to control their security (password security, account blocking, remote change, etc.)?
Secure hires and transfers of employees where security constraints have been identified (habilitation required)
When security constraints have been identified, such as national clearance requirements, do you check the background and profile suitability of new hires (criminal record/nationality)?
secure internet access to non- categorized websites or personal
If you have allowed browsing to non-professional websites, have you deployed a secure browsing solution for these sites that isolates it from the standard computer network?
Secure laptops against data spying
Do users have access to IT security resources related to travel on their laptops? (Screen filter, security cable, VPN, encryption, monitoring,...)
Secure Network architecture hardened
Do you have a network architecture that prioritize secure communications and allows non-secured protocols if mandatory under specific control and isolation from the rest of the network. For example, e...
Security access to supplier and subcontractor to information system
Do you secure network interconnections with your subcontractors and suppli-ers?
Segregate Website and internet accessible services from the rest of the company network.
If your website is hosted within the company, do you separate your website and Internet-accessible services from the rest of the company's network (via a segregated network zone, e.g. "DMZ")?
Servers & PC hardening
Do you implement a policy of security hardening of the configuration on your workstations and servers? [Industrial IT] [Corporate IT]
Set an email filtering when associated attachments have dangerous extension (.exe for example) or content
Is there a system for filtering valid e-mails against malicious ones? (Anti-spam, removal of suspicious attached files, etc...)
Set container solutions for corporate application / data on mobile device used for both personal and professional and not encrypted
Do you have complete control over the professional usage of enterprise appli-cations / data on mobile devices? (good separation of personal and professional environments)
Setup a risk analysis
Have you ever done a cyber-risk analysis on your company?
Setup secure and distinct physical sites for backup storage
Are your backups protected in a secure room?
Setup secure backup storage on cloud system
Do you use a centrally managed data storage and backup system, such as a cloud (AWS, O365 Sharepoint, OneDrive, google drive,...)?
Spare PC Update
Do you ensure that workstations in stock (spare) are updated before re-entry into service? [Industrial IT]
Specify governance with clear roles and responsibilities
Do you have an information systems security focal point (RSSI or equivalent)?
Strong authentication to webmail
Do you use secure authentication for connecting to your company emails from the Internet (double authentication with phone and/or blocking accounts against password attempts, regular password change,...
Sufficient ICT security resources to manage ICT security of the company with respect to the number of IT users / devices / employees
Is there a person or department assigned to the management the computer systems?
Suppliers in Continuity plan
Are your crisis management, continuity and disaster recovery plans designed to take into account your providers/suppliers? [Corporate IT]
Suppliers nominative accounts
Do you create nominative accounts for each employee of a provider company? [Industrial IT] [Corporate IT]
Supply chain risk assessment
Did you implement a cyber supply chain risk assessment process to identify, prioritize and assess your suppliers and third-party partners of information systems, components, and services? [Industrial...
Third party softwares versions control
In order to avoid potential vulnerabilities (unknown software, not updated...) do you verify the versions of the software installed on your computer park?
To remove devices storage
Do media devices awaiting for disposal stored in an environment with restricted and controlled access? [Industrial IT] [Corporate IT]
tool to alert and perform semi-automatic isolation or shut down of systems
Is there an alert tool to automatically shut down or isolate some elements of the computer system in the event of a major incident?
Track frequently system not up to date
Do you anticipate the end of software and system maintenance?
Up to date inventory of admin accounts
Do you have a complete inventory of privileged (administrative) accounts and do you keep it up to date?
USB antivirus scan
Does the antivirus automatically scan the servers, workstations and USB keys connected to the production benches? [Industrial IT] [Corporate IT]
USB cleaning multiple antivirus
One of the antivirus used on sheep dip is different from the one used on the workstations? [Industrial IT]
Users access procedure
Is there a procedure for creating, modifying and deleting access for users and administrators involved in production environments? [Industrial IT] [Corporate IT]
Verify compliance of entities
Do you check the compliance of your company's subsidiaries?
Verify compliance of entities, subsites
If you have several geographical IT sites, do you visit them to check physical and IT security regularly (min. once every 2 years) ?
Visitor escorting
Are visitors permanently accompanied on your premises?
Vulnerability management process
Did you define and implement a vulnerability management process for your services (identification, classification, prioritization, remediation and mitigation of vulnerabilities)? [Industrial IT] [Corp...
Web-application firewall for internally internet facing application
Do you protect your web servers accessible from outside the company's net-work with WAF (web access filtering) device?
When required, perform background check before employment.
When security constraints have been identified, such as national clearance requirements, do you check the background and profile suitability of new hired (e.g. criminal record/nationality) depending o...
Yearly Firewall Control
Do you check the configuration of the firewalls at least once a year?