Laserfiche WebLink
<br />©2025 Lumifi Cyber, Inc. All rights reserved. <br />PRIVATE - Controlled by Lumifi Cyber <br /> <br />20/25 <br />PRIVATE - Controlled by Lumifi Cyber <br />• Do you have cyber-insurance? Does it also cover fraud (phishing, phone <br />scams, Business Email Compromise (BEC))? <br />• Is data security and ownership covered in the procurement process and in <br />vendor contracts? <br />• How is Information Security Governance conducted? Describe the decision - <br />making processes for procurement, security decision making processes for <br />projects or decision-making processes for outsourcing, change control and <br />change management, compliance, risk management and governance? <br />• How are requests for exceptions to policy handled? <br />• Are Information Security and Acceptable Use Policies and Operational <br />Security Procedures documented? Are they maintained and reapproved <br />annually? Are they well known and do employees receive training on them? <br />• Is Security Awareness training conducted and how often? <br />• Is there an IR Plan and is it tested periodically with Tabletop Exercises <br />(TTEs)? <br />• Do you incorporate security into your procurement process and if so how? <br />• Is an Enterprise Security Risk assessment conducted annually? <br />• What regulations are you required to comply with and have you achieved <br />compliance with those regulations and standards (i.e. HIPAA, PCI, HIPAA, <br />CJIS, NERC CIP etc.)? <br />• Describe Monitoring, Alerting and Incident Response technology and <br />process <br />• Describe the Vulnerability Management process <br />• Describe any security testing processes <br />• Describe Security Requirements gathering for projects and procurement <br />• Describe the nature and management of operational Security <br />• Do you run security testing and how often? Vulnerability <br />assessment? Network penetration testing? Web application pentesting and <br />security code review? Wireless assessments? Phishing <br />exercise? Password cracking to test for strong passwords? Security <br />testing for digital printers, HVAC, other operational technology (OT)? <br />• Describe the operational security controls and technologies in use such as <br />Firewalls, IDS/IPS, DLP, Encryption, email security, SIEM, etc. in use and how <br />they systems are monitored for alerts?