2. Is the 2.1 Is the data backed up Examine backup procedures. information effectively? Interview about safe and Are backups tested and procedures and measures used secure? stored off-site? to classify and protect data. Is the frequency Test steps taken to protect data effective? and systems against a sample from the Top 35 Strategies to 2.2 Is the data safe from Mitigate Targeted Cyber Intrusions from the Australian Is the entity using Government Information controls for: Security Manual Application whitelisting Patching applications Patching operating system Minimising users with administrative privileges Disable local administrator accounts Application based workstation firewall Multi-factor authentication Network segmentation and segregation Host based intrusion detection/prevention system Centralised and logging 2.3 Is confidential data only available to appropriate people? Are access controls kept up to date? 2.4 Are access controls tested and monitored?
2. Is the information safe and secure? 2.1 Is the data backed up effectively? Are backups tested and stored off-site? Is the frequency effective? 2.2 Is the data safe from Is the entity using controls for: Application whitelisting Patching applications Patching operating system Minimising users with administrative privileges Disable local administrator accounts Application based workstation firewall Multi-factor authentication Network segmentation and segregation Host based intrusion detection/prevention system Centralised and logging 2.3 Is confidential data only available to appropriate people? Are access controls kept up to date? 2.4 Are access controls tested and monitored? Examine backup procedures. Interview about procedures and measures used to classify and protect data. Test steps taken to protect data and systems against a sample from the Top 35 Strategies to Mitigate Targeted Cyber Intrusions from the Australian Government Information Security Manual