If no one owns cybersecurity and policies aren't written down, every other control depends on memory and goodwill. Ownership is what keeps controls running after the project ends.
We have a written Information Security Policy, reviewed and approved within the last 12 months.
Who approved it? Is it version-controlled? Is the review date visible?
A named person owns cybersecurity (vCISO, CISO, or designated officer) with documented authority.
Is this in writing? Do they have budget authority and a seat with leadership?
Leadership reviews cyber risk at least quarterly, with meeting notes or a risk register update to show for it.
Are the notes archived? Does the agenda include security metrics?
We keep a current inventory of all hardware, software, and cloud services, updated within the last 90 days.
Does it include end-of-life status, data classification, and an owner for each item?
We have a documented data classification scheme (at minimum Public, Internal, CUI, and PII) and apply it consistently.
Do employees know where CUI lives? Is your CUI boundary drawn and documented? Is CUI labeled in SharePoint and email?
Vendor and third-party risk is assessed before anyone gets system access, with a risk rating and approval on file.
Do you have a vendor questionnaire? Who approves exceptions?
Stolen or reused credentials are one of the most common ways attackers get in. Identity controls are among the first things an assessor, a prime, or an insurer will ask about.
MFA is enforced on email, VPN, remote access, and all administrator accounts, with no exceptions for seniority.
Is it enforced through Conditional Access or policy, not just turned on for some users?
Privileged accounts are separate from daily-use accounts. Admins use a dedicated account for elevated tasks.
Is anyone browsing the web or reading email while signed in as a domain or global admin?
Access rights are reviewed and recertified at least every 90 days, with approvals documented.
Do accounts for people who left still exist? Do users have more access than their job needs?
Offboarding removes all access within 24 hours of separation, including Microsoft 365, VPN, SaaS apps, and shared accounts.
Is there a documented offboarding checklist with a sign-off?
Service account credentials are stored in a password or privileged access vault and rotated, not kept in spreadsheets or shared notes.
When did you last rotate the service account for your backup software?
Our password policy follows current NIST SP 800-63B guidance: at least 15 characters when a password is the only factor, no forced periodic changes, and screening against known-breached passwords.
Still forcing 90-day password changes? Current NIST guidance says to require a change when there is evidence of compromise, not on a calendar.
Many ransomware incidents start with an unpatched system, an exposed remote access service, or a flat network. Each No in this section is a practical place to reduce risk.
Every endpoint and server runs an EDR or MDR agent that is actively monitored, not legacy antivirus alone.
Does it cover servers as well as desktops? Who acts on the alerts, and how fast?
Disk encryption is enforced on all laptops and mobile devices, with recovery keys managed and escrowed.
Is BitLocker or FileVault enforced by policy on every device, or turned on by hand on a few? Where CUI is involved, is the encryption FIPS-validated?
Firewalls and switches have non-default credentials, and configuration changes are logged and reviewed.
When did you last review firewall rules? Are there any "permit any/any" rules?
Guest Wi-Fi is separated from corporate and OT networks by real network segmentation, not just a different SSID.
Can a guest device reach any internal resource? Can OT devices reach the internet?
Backups follow 3-2-1, with at least one immutable or offline copy kept off-site or in a separate cloud tenant.
Could ransomware on your network reach and encrypt your backup system?
Backups are test-restored at least quarterly, with a documented restore log, not just a "job completed" notice.
When did you last actually restore a file or a server from backup?
Email has DMARC enforced at p=quarantine or p=reject, with DKIM signing and an SPF record that ends in -all (hard fail).
Run your domain through a free checker such as MXToolbox or dmarcian. Surprises are common.
Plan for the day something gets through. Teams that have written down and practiced their response make faster, calmer decisions. Auditors and insurers want to see the plan and evidence that you tested it.
Security logs from endpoints, identity providers, and network devices are centralized and retained for at least 90 days.
Can you show who signed in, and from where, at 2 a.m. last Tuesday?
We have 24/7 security monitoring, in-house or through a managed detection and response (MDR) provider with documented response times.
What is the response time for alert triage? Who gets called at 2 a.m. on a Sunday?
A written Incident Response Plan exists and was tested in a tabletop exercise in the last 12 months, with results documented.
Does it cover ransomware and business email compromise? For defense work, does it include the 72-hour cyber incident reporting requirement in DFARS 252.204-7012?
Roles, escalation paths, and breach notification timelines are documented and current.
Does your team know the notification deadlines that apply to you: state law, HIPAA, FTC, and your contracts?
A business continuity and disaster recovery plan sets recovery time (RTO) and recovery point (RPO) targets for each critical system, and it has been tested.
What's your RTO for your ERP? For email? Does leadership know these numbers?
Cyber insurance is active and we've confirmed what it actually covers, including ransomware, business email compromise, and social engineering fraud.
Read the exclusions and conditions. Some policies limit coverage when required controls weren't in place.
Doing the work isn't enough if you can't show it. Frameworks expect documented evidence, and evidence takes time to build. Logs, access reviews, training records, restore tests, and meeting notes have to accumulate over months. They can't be created the week before an assessment.
We know which frameworks our contracts, customers, and regulators actually require, and we have that documented in writing.
Have you read the clauses in your contracts? DFARS 252.204-7012 sets the NIST SP 800-171 safeguarding and incident reporting requirements. DFARS 252.204-7021 is the clause that sets a CMMC level.
(CMMC / NIST 800-171) We have a current NIST SP 800-171 self-assessment score in SPRS and a System Security Plan (SSP) that covers every system inside our CUI boundary.
Does your SPRS score match what an assessor would find? Scores and annual affirmations are statements to the government, so they need to reflect reality.
(NIST 800-171) A Plan of Action and Milestones (POA&M) tracks every unmet requirement with an owner, a milestone, and a target date.
Is the POA&M a living document, or a spreadsheet nobody has opened in a year? Under CMMC Level 2, POA&Ms are limited and must be closed out within 180 days.
(FTC Safeguards) A Qualified Individual is named, and a written information security program is in place and documented.
The rule covers non-bank financial institutions under FTC jurisdiction, including many auto dealers, mortgage brokers, and tax preparers. Businesses with data on fewer than 5,000 consumers are exempt from a few requirements, not the whole rule.
(HIPAA) Business Associate Agreements (BAAs) are in place with every vendor that creates, receives, maintains, or transmits PHI.
Does your IT provider, MSP, or cloud storage vendor have a signed BAA on file?
(ISO 27001) A Statement of Applicability (SoA) is current, approved by management, and reflects the controls actually implemented.
Was the SoA updated after the last risk assessment?
We get an independent security assessment at least once a year (not just a self-review), with findings documented and tracked to closure.
A penetration test, vulnerability assessment, or independent readiness review all count. C3PAO assessments are not being designated in new DoD solicitations during the Phase 2 suspension, so check what your contracts and primes actually ask for.
Phishing and social engineering remain among the most common ways in. Training records are also evidence: after an incident, regulators and customers ask to see them.
All staff complete security awareness training at least annually, with simulated phishing and completion rates tracked.
Do you have completion records? What's your click rate on phishing simulations, and is it going down?
Engineers, IT staff, and other technical roles get role-based security training each year, such as secure configuration or OT/ICS security.
NIST SP 800-171 calls for training people on their specific security duties (requirement 3.2.2). General awareness training alone doesn't cover that.
New hires complete security onboarding before they get system access, not sometime during their first week.
Is security awareness part of the hiring packet, or an afterthought?
Acceptable Use and Remote Work policies are signed by every employee each year, with signed copies on file.
Do contractors sign them too? Does the remote work policy reflect how people actually work today?
There is a clear, no-blame way to report suspicious activity, and people actually use it.
Has anyone used it in the last 6 months? Silence usually means people are unsure or worried about blame, not that nothing happened.
Most companies use more cloud apps than IT knows about. Unmanaged SaaS and AI tools can quietly move sensitive data outside the systems you've secured.
Our Microsoft 365 or Google Workspace tenant has a hardened baseline (CIS Benchmark or equivalent), and the settings have been validated, not assumed.
Run Microsoft Secure Score or a Maester check. Default settings are not a security baseline.
Conditional Access or similar policies block legacy authentication and flag risky sign-ins automatically.
Is legacy authentication blocked everywhere, including old scanners, apps, and service accounts?
Shadow IT SaaS apps are discovered and inventoried at least quarterly, and unapproved apps are blocked or documented.
Do you know every app employees have connected to their work account?
Customer and regulated data in cloud apps is covered by active DLP rules, and someone reviews and acts on the alerts.
Could an employee email a spreadsheet of Social Security numbers to a personal account without any alert?
An AI Acceptable Use Policy covers ChatGPT, Copilot, Gemini, and similar tools, and employees have signed it.
Do employees know they can't paste CUI or customer data into public AI tools?
Sensitive and regulated data is technically blocked or masked from public AI tools, not just covered by policy.
A policy sets the rule. Technical controls make sure it's followed.
Physical access and supply chain risks are easy to overlook, especially on shop floors, job sites, and in clinics. NIST SP 800-171 includes physical protection and media protection requirements for systems that handle CUI.
Physical access to server rooms, network closets, and workstations is restricted, logged, and reviewed.
Is the server room locked? Who has a key? When was the key list last checked?
Hardware and software vendors are screened for supply chain risk, with an approved vendor list documented.
For government work, have you confirmed you don't use telecom or video surveillance equipment covered by Section 889 of the FY2019 NDAA (for example Huawei, ZTE, Hytera, Hikvision, or Dahua)?
Removable media (USB drives, external drives) is controlled: blocked by policy and technical controls, or tracked and approved.
Can an employee plug any USB drive into a computer that handles CUI?
Media containing sensitive data is sanitized or destroyed following NIST SP 800-88 before disposal, reuse, or decommissioning.
Do you have a certificate of destruction from your hardware recycler?
We'll jump you to the next unanswered question.
The October 2026 edition of our 20-page Compliance Readiness Checklist. Same 47 questions, with room for evidence, owners, and notes, plus a plain-English update on where CMMC stands after the July 2026 Phase 2 suspension. Work through it with your team.
Updated October 2026. For education and self-assessment, not legal advice.
Once you know your gaps, here's how we close them.