NIST CSF Quick Check

About this program

Controls (24)

1. Is there a documented cybersecurity strategy that aligns with business objectives and is reviewed annually by leadership?

   Medium

   This control ensures the organization maintains a formally documented cybersecurity strategy that directly supports and aligns with enterprise business objectives, risk appetite, and operational priorities. The strategy must be reviewed and approved at least annually by executive leadership or the…

   How to test + evidence

   Risk: A reviewed strategy is alive — auditors discount unreviewed documents as nominal.

   Testing procedure: Inspect the strategy document. Verify board/leadership approval + last review within 12 months. Confirm strategic objectives map to business outcomes.

   Evidence to collect: Cyber strategy document with version Board minutes referencing strategy Annual review log Mapping to business objectives

2. Are cyber roles, responsibilities, and accountabilities clearly defined and communicated?

   Medium

   This control ensures that all personnel involved in cybersecurity operations have formally documented roles with explicit responsibilities, authorities, and accountability mechanisms. It requires organizations to maintain up-to-date role definitions (e.g., CISO, security analysts, incident responders, system owners) in accessible formats…

   How to test + evidence

   Risk: Without RACI, gaps and conflicts hide in everyday process. Auditors trace specific activities to people.

   Testing procedure: Inspect RACI matrix + named executive sponsor. Test by asking 3 random staff who owns IR / privacy / vendor risk.

   Evidence to collect: RACI matrix with named individuals Executive sponsor with delegation Job descriptions referencing cyber duties

3. Is there a formal cyber risk register reviewed by management at least quarterly?

   Medium

   A formal cyber risk register is a centralized, documented inventory of identified cybersecurity threats, vulnerabilities, and risks, each assessed for likelihood and impact, with assigned ownership and mitigation strategies. Management reviews this register at least quarterly to track changes in…

   How to test + evidence

   Risk: Quantified + quarterly forces real conversation. Annual qualitative registers produce noise that doesn't inform decisions.

   Testing procedure: Inspect risk register + last 4 quarterly reviews. Verify risks have owners + treatment decisions.

   Evidence to collect: Risk register snapshot Quarterly review minutes Risk treatment plans with owners Risk appetite statement

4. Do you have a third-party / supply-chain risk management programme (assessments, monitoring, contractual controls)?

   Medium

   A third-party and supply-chain risk management programme systematically identifies, assesses, and monitors cybersecurity risks introduced by vendors, suppliers, service providers, and business partners who access organizational systems, handle sensitive data, or deliver critical services. The programme combines pre-engagement due diligence…

   How to test + evidence

   Risk: Most breaches now arrive via supply chain. Continuous monitoring catches degradation between onboarding and incident.

   Testing procedure: Sample 25 vendors. Verify questionnaire on file, contractual clauses, ongoing monitoring (security ratings).

   Evidence to collect: Vendor register with criticality Onboarding security questionnaires Contractual IS clauses Continuous monitoring tooling output

5. Do you have an up-to-date inventory of hardware, software, and data assets?

   Medium

   This control requires the organization to maintain a current, comprehensive inventory of all hardware devices (servers, workstations, mobile devices, network equipment), software applications (licensed, open-source, SaaS), and data assets (databases, file repositories, classified datasets). The inventory must include identifying attributes…

   How to test + evidence

   Risk: Automated discovery catches shadow IT; manual inventories miss it. You can't protect what you don't know you have.

   Testing procedure: Inspect asset inventory. Sample 10 assets observed in walkthrough — confirm in inventory.

   Evidence to collect: Asset inventory export Discovery tooling (Lansweeper, Tanium, ServiceNow) Last review date

6. Is sensitive data classified and labelled (e.g. confidential, internal, public)?

   Medium

   This control requires organizations to implement a structured data classification scheme that categorizes information assets according to their sensitivity, business impact, and handling requirements. Classification labels (such as Public, Internal, Confidential, Restricted) must be assigned to data at creation or…

   How to test + evidence

   Risk: Automated classification + DLP makes labels enforceable. Policy without enforcement is theatre.

   Testing procedure: Inspect classification policy + sample data assets. Verify labels applied + DLP rules enforce restrictions.

   Evidence to collect: Classification scheme Sample labelled assets DLP rules per classification Records of processing

7. How mature is your vulnerability management programme?

   Medium

   A vulnerability management programme encompasses the systematic identification, classification, remediation, and mitigation of security vulnerabilities across all organizational assets. Maturity is measured by the programme's ability to discover vulnerabilities across the full attack surface, prioritize remediation based on risk, enforce…

   How to test + evidence

   Risk: Risk-based + KEV aligned is the modern bar. Equal-severity patching wastes resources without reducing risk.

   Testing procedure: Inspect scanner output + patching SLAs. Sample 10 critical CVEs from period and confirm SLA met.

   Evidence to collect: Vuln scanner reports Patch SLA per severity KEV monitoring Sample patch deployment records

8. How are identities and access managed?

   Medium

   Identity and Access Management (IAM) encompasses the policies, processes, and technologies used to provision, authenticate, authorize, and deprovision user accounts across enterprise systems. This control ensures that only verified identities receive access appropriate to their role, that authentication mechanisms meet…

   How to test + evidence

   Risk: Identity is the new perimeter. SSO + MFA + JIT eliminates standing privilege as the most-attacked target.

   Testing procedure: Inspect SSO + MFA coverage. Verify privileged access governed (PAM, JIT). Sample access reviews.

   Evidence to collect: SSO app catalogue MFA policy + login records PAM tooling logs Quarterly access review reports

9. How are endpoints protected?

   Medium

   Endpoint protection encompasses the deployment and management of security controls on user workstations, laptops, mobile devices, and servers to prevent, detect, and respond to threats. This includes anti-malware software, host-based firewalls, application whitelisting, endpoint detection and response (EDR) tools, patch…

   How to test + evidence

   Risk: EDR + FDE is the modern endpoint baseline. Configuration management prevents drift.

   Testing procedure: Pull EDR + FDE + MDM coverage reports. Sample 10 endpoints; verify each has full stack.

   Evidence to collect: EDR coverage report FDE status MDM enrolment + compliance Configuration baseline

10. Is sensitive data protected with encryption (at rest, in transit) and DLP?

    Medium

    This control ensures that sensitive data is protected through cryptographic mechanisms both when stored (at rest) and during transmission (in transit), supplemented by Data Loss Prevention (DLP) tools that monitor, detect, and block unauthorized data movement. Encryption at rest protects…

    How to test + evidence

    Risk: Encryption everywhere is necessary; DLP enforcement is what stops the data leaving.

    Testing procedure: Verify encryption-at-rest on storage + databases. Inspect DLP rules + alerts.

    Evidence to collect: Encryption status per service KMS / key management config DLP rules + sample alerts Classification labels

11. Is security awareness training delivered consistently across the organisation?

    Medium

    This control ensures security awareness training is delivered uniformly to all personnel across business units, locations, and employment types (full-time, contractors, third-parties with access). A consistent training program includes standardized content, defined frequency (typically annual with onboarding), tracking mechanisms, and…

    How to test + evidence

    Risk: Annual training has decaying effect. Continuous + simulations changes behaviour.

    Testing procedure: Pull training matrix + completion. Inspect simulated phishing reports.

    Evidence to collect: Training catalogue with role mapping Completion percentages Phishing simulation results trend

12. Is your network segmented and protected with modern controls (NGFW, ZTNA, microsegmentation)?

    Medium

    Network segmentation divides an organization's network into isolated zones based on function, data sensitivity, or trust level, preventing lateral movement of attackers and containing breaches. Modern controls include Next-Generation Firewalls (NGFW) that inspect application-layer traffic and apply identity-aware policies, Zero…

    How to test + evidence

    Risk: Flat networks let ransomware spread. Zero-trust is the modern target.

    Testing procedure: Inspect network architecture + firewall rule set. Test east-west blocking.

    Evidence to collect: Network architecture diagram Firewall rule set + last review ZTNA deployment status

13. Are logs centralised in a SIEM with detection rules tuned to your environment?

    Medium

    This control establishes whether security event logs from across the enterprise (endpoints, servers, network devices, cloud services, applications) are aggregated into a Security Information and Event Management (SIEM) platform with detection rules customized to reflect the organization's technology stack, threat…

    How to test + evidence

    Risk: Tuned detection content turns logs into actionable signal. Default rules miss the specific TTPs in your environment.

    Testing procedure: Inspect SIEM coverage + detection rules. Sample alerts triaged in the period.

    Evidence to collect: SIEM coverage matrix Detection rule list with last-tuned dates MITRE ATT&CK coverage Threat hunt reports

14. Who monitors security alerts and how often?

    Medium

    This control establishes accountability and timeliness for security alert monitoring by defining named individuals or roles responsible for reviewing alerts and specifying monitoring frequencies (continuous, hourly, daily, etc.). It ensures alerts from SIEM, IDS/IPS, EDR, firewalls, and other security tools…

    How to test + evidence

    Risk: 24/7 collapses dwell time. Business-hours-only response means an attack on Friday evening has all weekend.

    Testing procedure: Inspect SOC roster / MDR contract. Verify mean-time-to-acknowledge metric.

    Evidence to collect: SOC roster / MSSP contract On-call schedule MTTA / MTTR metrics

15. Do you consume and act on threat intelligence relevant to your industry?

    Medium

    This control ensures the organization subscribes to and operationalizes threat intelligence feeds, reports, and indicators of compromise (IoCs) relevant to its industry sector, technology stack, and geographic footprint. Threat intelligence sources may include commercial vendors, ISACs/ISAOs, open-source feeds (e.g., CISA…

    How to test + evidence

    Risk: Integration into detection content is what makes intel actionable. Manual review at scale doesn't convert to defence.

    Testing procedure: Inspect intel sources + workflow. Trace 3 specific items to actions.

    Evidence to collect: Threat intel feeds + ingest method Sample detection rules sourced from intel Briefings to leadership

16. Are user and entity behaviour anomalies (UEBA) monitored?

    Medium

    User and Entity Behavior Analytics (UEBA) monitoring establishes baselines of normal behavior for users, devices, and applications, then detects statistical anomalies that may indicate compromised credentials, insider threats, lateral movement, or privilege abuse. UEBA systems correlate behavioral signals—such as abnormal…

    How to test + evidence

    Risk: UEBA catches account takeover that signature detection misses. Auto-response collapses time-to-contain.

    Testing procedure: Inspect UEBA tooling + sample alerts. Verify auto-response on high-risk sign-ins.

    Evidence to collect: UEBA tool config Sample anomaly alerts Auto-response policy (token revocation, MFA challenge)

17. Do you have a written incident response plan with playbooks for common scenarios?

    Medium

    An incident response plan is a documented, formally approved process that defines roles, responsibilities, communication protocols, and technical procedures for detecting, analyzing, containing, eradicating, and recovering from cybersecurity incidents. Playbooks are scenario-specific sub-procedures that provide step-by-step instructions for common incident…

    How to test + evidence

    Risk: Generic plans rarely survive specific scenarios. Scenario playbooks force the right pre-decisions.

    Testing procedure: Inspect IR plan + scenario playbooks. Verify last tabletop after-action.

    Evidence to collect: IR plan with version + approval Scenario playbooks Latest tabletop after-action report

18. When did you last run a tabletop exercise involving the executive team?

    Medium

    Tabletop exercises involving executive leadership simulate crisis scenarios to validate incident response plans, test decision-making under pressure, and clarify communication protocols during cybersecurity events. These exercises engage C-suite and board members in realistic threat scenarios—such as ransomware, data breaches, or…

    How to test + evidence

    Risk: Tabletops surface decision-making gaps no document review can. Exec team needs to make hard calls before live event.

    Testing procedure: Inspect after-action report + executive attendance.

    Evidence to collect: Tabletop attendance list Scenario brief Action tracker

19. Do you have an IR retainer or breach coach pre-agreed?

    Medium

    An incident response (IR) retainer or breach coach agreement is a pre-negotiated contract with external legal counsel, forensic investigators, or specialized IR firms that establishes scope, rates, response timelines, and communication protocols before an incident occurs. These agreements enable immediate…

    How to test + evidence

    Risk: IR firms saturate during major events. Retainer guarantees response.

    Testing procedure: Inspect retainer contract. Confirm 24/7 contact + last test call.

    Evidence to collect: Retainer contract Escalation runbook Test call log

20. Is there a clear communications plan for incidents (internal, customer, regulator, media)?

    Medium

    An incident communications plan defines pre-authorized communication channels, roles, templates, and escalation procedures for notifying internal stakeholders, affected customers, regulatory bodies, and the media during and after a security incident. The plan specifies thresholds that trigger each type of notification,…

    How to test + evidence

    Risk: Comms drive press perception + legal exposure. Drafting under pressure produces wrong words.

    Testing procedure: Inspect comms plan + templates per audience.

    Evidence to collect: Comms plan with approval flow Templates per audience Regulator notification timelines

21. Are backups isolated, immutable, and tested?

    Medium

    This control ensures that backup data is protected from unauthorized modification or deletion through three mechanisms: isolation (network or air-gap separation from production systems), immutability (write-once-read-many or append-only storage that prevents tampering), and regular restoration testing. Immutable backups prevent ransomware…

    How to test + evidence

    Risk: Immutable + tested defeats ransomware's most damaging move. Untested is faith.

    Testing procedure: Inspect backup architecture + restore test report.

    Evidence to collect: Backup architecture diagram Immutability config Restore test report

22. Are RTO and RPO defined for critical systems and validated?

    Medium

    Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are quantitative thresholds that define the maximum acceptable downtime and data loss for critical systems during disruption. Organizations must formally document these metrics for each system based on business impact analysis,…

    How to test + evidence

    Risk: Tested RTO is what you can commit to. Untested is wishful thinking.

    Testing procedure: Inspect BIA + restore drill report.

    Evidence to collect: BIA with RTO/RPO Restore drill report Plans updated where missed

23. Is there a written disaster recovery / business continuity plan?

    Medium

    A written disaster recovery and business continuity plan (DR/BCP) is a documented set of procedures and instructions to enable critical business functions to continue during and after a disruptive incident, such as natural disasters, cyberattacks, system failures, or other catastrophic…

    How to test + evidence

    Risk: Annual exercise validates the plan. Documented but unexercised plans fall apart on contact with reality.

    Testing procedure: Inspect BCP/DR plan + last exercise report.

    Evidence to collect: BCP/DR plan with version Last exercise report Lessons learned actioned

24. Are post-incident lessons-learned captured and acted on?

    Medium

    Post-incident lessons-learned is a structured process that captures findings, root causes, and improvement opportunities following security incident resolution. Organizations conduct formal review sessions with incident response team members and stakeholders, document observations in standardized reports, and track remediation actions through…

    How to test + evidence

    Risk: Lessons closed and reflected in updates turn each incident into improvement. Without action closure you fix the same issue six times.

    Testing procedure: Inspect post-mortem template + completed examples + action tracker.

    Evidence to collect: Post-mortem template Sample post-mortems Action tracker with closure