YouAttest GRC Survey for ISO 27001/2022 YouAttest is a certified identity re-certification tool that automates identity governance. This survey will help determine if your security and governance would improve with YouAttest. Does your organization define and allocate information security roles and responsibilities according to organizational needs? ISO Standard 5.2Information security roles and responsibilities: Control Information security roles and responsibilities shall be defined and allocated according to the organization needs. Please select your answer Yes No Does your organization collect and analyze information relating to information security threats to produce threat intelligence? ISO Standard 5.7Threat intelligence: Information relating to information security threats shall be collected and analysed to produce threat intelligence. Please select your answer Yes No Does your organization develop and maintain an inventory of information and other associated assets, including owners? ISO Standard 5.9Inventory of information and other associated assets: An inventory of information and other associated assets, including owners, shall be developed and maintained. Please select your answer Yes No Does your organization identify, document, and implement rules for the acceptable use and procedures for handling information and other associated assets? ISO Standard 5.1Acceptable use of information and other associated assets: Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented. Please select your answer Yes No Does your organization establish and implement rules to control physical and logical access to information and other associated assets based on business and information security requirements? HIPPA Standard 5.15Access control: Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements Please select your answer Yes No Does your organization provision, review, modify, and remove access rights to information and other associated assets in accordance with the organization’s topic-specific policy on and rules for access control? ISO Standard 5.18Access Rights: Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control. Please select your answer Yes No Does your organization establish processes for acquisition, use, management, and exit from cloud services in accordance with information security requirements? ISO Standard 5.23Information security for use of cloud services: Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements. Please select your answer Yes No Does your organization assess information security events and decide if they are to be categorized as information security incidents? ISO Standard 5.25Assessment and decision on information security events: The organization shall assess information security events and decide if they are to be categorized as information security incidents. Please select your answer Yes No Does your organization identify and meet requirements regarding the preservation of privacy and protection of PII according to applicable laws, regulations, and contractual requirements? ISO Standard 5.34Privacy and protection of personal identifiable information (PII): The organization shall identify and meet the requirements regarding the preservation of privacy and PII according to applicable laws and regulations and contractual requirements. Please select your answer Yes No Does your organization regularly review compliance with the information security policy, topic-specific policies, rules, and standards? ISO Standard 5.36Compliance with policies, rules and standards for information security: Compliance with the organization’s information security policy, topic-specific policies, rules and standards shall be regularly reviewed. Please select your answer Yes No Does your organization restrict and manage the allocation and use of privileged access rights? ISO Standard 8.2Privileged access rights: The allocation and use of privileged access rights shall be restricted and managed. Please select your answer Yes No Does your organization restrict access to information and other associated assets in accordance with the established topic-specific policy on access control? ISO Standard 8.3Information access restriction: Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control. Please select your answer Yes No Does your organization appropriately manage read and write access to source code, development tools, and software libraries? ISO Standard 8.4Access to source code: Read and write access to source code, development tools and software libraries shall be appropriately managed. Please select your answer Yes No Does your organization obtain information about technical vulnerabilities of information systems, evaluate exposure, and take appropriate measures? ISO Standard 8.8Management of technical vulnerabilities: Information about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities shall be evaluated and appropriate measures shall be taken. Please select your answer Yes No Does your organization segregate groups of information services, users, and information systems in the organization’s networks? ISO Standard 8.22Segregation of networks: Groups of information services, users and information systems shall be segregated in the organization’s networks. Please select your answer Yes No 1 out of 15 Thank you for completing the ISO 27001/2022 Assessment! Your responses have been successfully recorded, and your personalized results are now available. Below, you’ll find your overall score along with a detailed breakdown of key controls that may require attention. Use these insights to strengthen and refine your security posture. Important: Please fill out the contact form below, to retrieve your full results and in-depth analysis. Name Email Business Phone GRC Partner Email (optional) Time's up
