restricted to a limited number of No authorised individuals? 20 Are special access privileges documented Yes and reviewed regularly (e.g. quarterly)? No 21 Are all administrative accounts only Yes permitted to perform administrator activity, with no Internet or external No email permissions? 22 Does your password policy enforce Yes changing administrator passwords at least every 60 days to a complex No password? Please provide any additional evidence to support your assertions above: Malware Protection Question Answer Comment 23 Please confirm that malware protection Always software has been installed on at least all computers with an ability to connect Mostly outside of the network in Scope Sometimes Rarely Never 24 Does corporate policy require all malware Yes protection software to have all engine updates applied, and is this applied No rigorously? 25 Have all anti malware signature files been Yes kept up to date (through automatic updates or through centrally managed No deployment)? 26 Has malware protection software been Yes configured for on-access scanning, and does this include downloading or opening No files, opening folders on removable or remote storage, and web page scanning? 27 Has malware protection software been Yes configured to run regular (at least daily) scans? No 28 Are users prevented from running Always executable code or programs form any
restricted to a limited number of authorised individuals? No 20 Are special access privileges documented and reviewed regularly (e.g. quarterly)? Yes No 21 Are all administrative accounts only permitted to perform administrator activity, with no Internet or external email permissions? Yes No 22 Does your password policy enforce changing administrator passwords at least every 60 days to a complex password? Yes No Please provide any additional evidence to support your assertions above: Malware Protection Question Answer Comment 23 Please confirm that malware protection software has been installed on at least all computers with an ability to connect outside of the network in Scope Always Mostly Sometimes Rarely Never 24 Does corporate policy require all malware protection software to have all engine updates applied, and is this applied rigorously? Yes No 25 Have all anti malware signature files been kept up to date (through automatic updates or through centrally managed deployment)? Yes No 26 Has malware protection software been configured for on-access scanning, and does this include downloading or opening files, opening folders on removable or remote storage, and web page scanning? Yes No 27 Has malware protection software been configured to run regular (at least daily) scans? Yes No 28 Are users prevented from running executable code or programs form any Always
Cyber-Essentials-Questionnaire-2016-v5.1-TuV-SUD.docx