Okta Compliance & Regulation Risk Assessment
Eight simple questions to test where your organisation currently stands
As cybersecurity and IT landscapes continue to expand, keeping up with increasingly stringent data privacy and compliance regulations can be a major challenge. To help determine where your organisation currently stands and how you match up against your peers, please answer the following six questions.
1
Regulations for modern workplaces
All relevant security requirements for modern workplaces should be documented in a mandatory security guideline for all workers and work-places. It should also be coordinated with the existing business owners of the institution and with all relevant departments, and shall be clarified under which conditions employees with mobile IT systems are allowed to access internal information of their institution.
Has the organisation appropriate policies and procedures documented to define a guideline for modern workplaces for the organisation?
2
Strategy and security policy for cloud use
The legal and organisational framework conditions as well as the technical requirements resulting from the use of cloud services must be examined. It must be determined which services in which delivery model are to be obtained from a cloud service provider in the future. This should document security requirements for the cloud service provider as well as the defined level of protection for cloud services in terms of confidentiality, integrity and availability.
Has a security policy for use been established based on the cloud usage strategy?
3
Workplace everywhere
The framework conditions of labour law and occupational health and safety law should also be observed and regulated for mobile working. All relevant points should be regulated either by company agreements or by individual agreements between the mobile employee and the employer in addition to the employment contract.
Has a company agreement for modern workplaces been established for your employees in the company, which reflects the legal frameworks of the employees in the respective regions?
4
Digital Identity Management
Digital Identities are the new perimeter of organisational architectures. When using an identity and access management system, it should be appropriate for the institution and its respective business processes, organisational structures and workflows as well as its protection requirements. Permissions may only be assigned on the basis of actual need and necessity for the fulfilment of tasks (principle of least privileges and need-to-know).
Has the organisation implemented a centralised authentication service that supports all resources used by the organisation?
5
Workplace everywhere
The framework conditions of labour law and occupational health and safety law should also be observed and regulated for modern working. All relevant points should be regulated either by company agreements or by individual agreements between the mobile employee and the employer in addition to the employment contract.
Has your organisation settled on a company agreement about rights and duties on how to use modern workplaces and infrastructures?
6
Loss of confidentiality of sensitive information
Users of modern workplaces must be made particularly aware of the value of mobile IT systems and the value of the information stored on them. They must be educated about the specific threats and measures of the IT systems they use. They must also be informed about what kind of information it is allowed to process on which IT systems. All users must be made aware of the applicable regulations.
Has the organisation’s employees been properly trained in the organisation’s standards for confidentiality of sensitive information?
7
Timely detection of security events
A proven and systematic approach is needed to centralise log monitoring and observe unwanted behaviours and events across your organisation. Aggregated data from multiple systems must be analysed to catch abnormal behaviour or potential cyberattacks. All digital identities, services and devices should report into a centralised alerting system.
Has the organisation deployed central components to detect, process and evaluate security-relevant events?
8
Establish a policy for handling security incidents
A security incident handling policy shall be established. It must define the purpose and objective of the policy and regulate all aspects of security incident handling. It shall describe the rules of conduct for the different types of security incidents. All employees shall be aware of the policy. All affected internal and external departments must be informed of a security incident in a timely manner.
Has the organisation implemented incident playbooks to describe security-relevant events and written reporting routes for each of these events?
