“Do we rely on our IT support team to develop and maintain our Cybersecurity strategy and compliance?”

“Do we have a set of policies, procedures and programs that allow us to measure, learn and improve our security posture?”

“Do we hold quarterly Information Security Committee meetings to assess our security alignment?”

“How are we keeping our most important clients’ data safe?”

“Are we alerted promptly when our proprietary or confidential data is copied off our network?”

“Are our employees trained on our security policies and procedures before they are given user accounts?”

“Who gets alerted when abnormal user behavior takes place? (example: user1 logs in from the UK, and then immediately logs in again from China)”

“Are there any dormant user accounts that have not been used in more than 30 days?”

“Do we have a policy that defines how privileged accounts are requested and approved?”

“Would we know if a hacker logs onto one of our computers at 2AM in the morning?”

“Are we alerted when a user account has been compromised?”

“How often do we test our Cybersecurity strength by performing penetration testing and red team exercises?”

“Are we alerted when a cybercriminal attempts to access our systems and data?”