YouAttest GRC Survey for NIST CSF 2.0 YouAttest is a certified identity re-certification tool that automates identity governance. This survey will help determine if your security and governance would improve with YouAttest. Does your organization include cybersecurity risk management activities and outcomes in enterprise risk management processes? NIST Standard GV.RM-03Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Please select your answer Yes No Does your organization establish lines of communication across the organization for cybersecurity risks, including from suppliers and third parties? NIST Standard GV.RM-05Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties Please select your answer Yes No Does your organization establish, communicate, and enforce policy for managing cybersecurity risks based on context, strategy, and priorities? NIST Standard GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced Please select your answer Yes No Does your organization establish, communicate, understand, and enforce roles, responsibilities, and authorities related to cybersecurity risk management? NIST Standard GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced Please select your answer Yes No Does your organization review cybersecurity risk management strategy outcomes to inform and adjust strategy and direction? NIST Standard GV.OV-01Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction Please select your answer Yes No Does your organization identify and record internal and external threats to the organization? NIST Standard ID.RA-03Internal and external threats to the organization are identified and recorded Please select your answer Yes No Does your organization use threats, vulnerabilities, likelihoods, and impacts to understand inherent risk and inform risk response prioritization? NIST Standard ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization Please select your answer Yes No Does your organization manage, assess for risk impact, record, and track changes and exceptions? NIST Standard ID.RA-07Changes and exceptions are managed, assessed for risk impact, prioritized, communicated, and tracked Please select your answer Yes No Does your organization define, manage, enforce, and review access permissions, entitlements, and authorizations, incorporating least privilege and separation of duties? NIST Standard PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, reviewed, and incorporate the principles of least privilege and separation of duties Please select your answer Yes No Does your organization manage, monitor, and enforce physical access to assets commensurate with risk? NIST Standard PR.AA-06Physical access to assets is managed, monitored, and enforced commensurate with risk Please select your answer Yes No Does your organization protect the confidentiality, integrity, and availability of data-at-rest? NIST Standard PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected Please select your answer Yes No Does your organization protect the confidentiality, integrity, and availability of data-in-transit? NIST Standard PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected Please select your answer Yes No Does your organization generate and make log records available for continuous monitoring? NIST Standard PR.PS-04Log records are created, protected, maintained, and analyzed Please select your answer Yes No Does your organization prevent installation and execution of unauthorized software? NIST Standard PR.PS-05Installation and execution of unauthorized software are prevented Please select your answer Yes No Does your organization perform analysis to establish what has taken place during an incident and the root cause? NIST Standard RS.AN-03Analysis is performed to establish what has taken place during an incident and the root cause of the incident Please select your answer Yes No 1 out of 15 Thank you for completing the NIST CSF 2.0 Assessment! Your responses have been successfully recorded, and your personalized results are now available. Below, you’ll find your overall score along with a detailed breakdown of key controls that may require attention. Use these insights to strengthen and refine your security posture. Important: Please fill out the contact form below, to retrieve your full results and in-depth analysis. Name Email Business Phone GRC Partner Email (optional) Time's up
