Business Resilience Survey

How have you mapped the critical services and products within your organisation and the platforms they depend on (these may fluctuate throughout the year)?

Using a central IT Team to map across functions (cross function)

Using external experts to map across functions (cross function)

Questionnaire to function leaders (linear)

Have not completed this

Other method

How do you manage and understand the interdependencies between various IT platforms in your organisation?

Internal analysis

External expert analysis

Have not completed this

Through function leads or holistic overview

Other method

What level of stakeholders have been consulted in identifying the critical services within your organisation?

Executive board

Essential/front end users

Third party integrators

All levels

None

How do you map critical third-party suppliers within your systems?

Through function outputs

Understanding what/who supports your critical services and products

Data impact assessments

Other

Nor completed

How have you assessed your IT network to identify areas for shutdown and protection, such as determining if you have a flat network or adequate segmentation and how is this linked into your IT disaster recovery programme?

Internal IT team in isolation of functions

IT Team and functions working together

External experts providing non bias overview

Other

Not been completed

How do you identify and understand what could make your organisation a target and who potential threat actors are before or during a cyber attack?

Annual strategic threat assessment

Half year/quarterly reviews

Horizon scanning bespoke to your organisation

Off the shelf/ generalised scanning assessments

Not at all

How does your organisation obtain/complete a strategic threat assessment in order to understand and prioritise mitigation of impact of threats cyber or other?

News outputs/alerts

External expert threat intelligence providers

Functions completing assessments in isolation

Not at all

Not known

What is your understanding of the legal requirements for notifying government agencies about data breaches/cyber-attack in the countries you operate within?

Full understanding

No understanding

Partial understanding

How do you access specialist legal advice related to cyber incidents?

In house expertise

On call external legal team

None

Not known

How would you obtain specialist intermediary advice to negotiate/pay with threat actors?

Through law enforcement advice/recommendation

Through your own research to locate a company/consultant

Peer Recommendations

Own internal specialists

Don't know

How would you obtain relevant threat actor intelligence to assist in decision making during a cyber crisis event?

Internal intelligence team

External intelligence experts

Law enforcement

Don’t know

What is the framework within your organisation to protect business critical information from leaking out into the public domain?

Non Disclosure Agreement process

Need to know briefing process

Everyone knows everything

Don’t know

Other

How is your crisis control structure organised, including defined roles, responsibilities, and access to specialists for different types of crises?

Via a regularly reviewed and tested crisis management plan

Ad hoc - bringing specialists in when they are needed

Retained external crisis team on call

Not known

Do not have a structure

How have you established a crisis response methodology that informs all levels of your business?

Learning as a result of a crisis (reactive)

Resource allocation of a business resilience team to write review and practice crisis response (proactive)

Not at all

External crisis response team to write and review (proactive)

During an incident, how do you conduct ongoing risk assessments to assist with informed decision-making, such as whether to pay or not pay or to shut down operations?

Pre defined decision tool kit

Reactionary whilst under pressure

Crisis functionality has in built-in risk reviews

Don’t know

Panic - it wasn’t in your job description and quite frankly you don’t get paid enough for this

How is your internal and external communications managed within a crisis event to all relevant stakeholders?

Pre-planned communications strategy

Reactionary during crisis

Not considered this as an issue

Do not know who crisis stakeholders would be

Have you got a defined terms of reference and roles/responsibilities for managing a crisis event?

Yes