Security Questionnaire 2024

Restricted

Internal

Public

Confidential

Following the personal preferences of the manager

Randomly

Based on the content and the recipient

All documents are public

Integrating confidentiality from the beginning of the design process

Complying with the minimum legal confidentiality standards

Consulting confidentiality experts only after development

Adding privacy features only if requested by the client

For continuously assessing the security risks associated with AI

I don't need to ask security team, AI can generate the risk assessment as well

For focusing only on AI performance

For applying the same security standards as for other technologies

Notify the security team and your manager to identify the extent of the breach and the data impacted

Wait to see the impact of the breach before reporting

Change all passwords without investigating the breach

Immediately notify all clients regardless of the analysis

Report only to higher-ups without formal documentation

Send a general email to the entire company to warn of the problem

Immediately report to the IT team

Wait for a team meeting to discuss the problem

Granting restricted access during employee integration then obtaining higher access based on seniority

Granting only the rights needed to perform the assigned tasks

Allowing high access based on responsibility

Providing administrator access to avoid frequent access restrictions

Simplifying processes by assigning multiple tasks to a single employee

Concentrating expertise to accelerate decision-making

Reducing the risks of fraud and operational errors

Increasing dependence among employees to improve collaboration

Only for financial transactions

When two people must independently verify and approve a task or transaction

When resources are limited and require less frequent double verification

When tasks are too complex for one person

Only in case of data breaches or security incidents

According to a pre-established schedule based on a risk assessment and significant changes in the organization

Every five years regardless of operational changes

Once when the document is introduced without future revisions

Focusing security on the least critical aspects of the system

Ensuring that security is an afterthought

Applying security only in the final phases of development

Integrating security measures from the early phases of development

Continuous monitoring of data breaches

Periodic reviews of privacy procedures

Consultations with lawyers specialized in personal data

For each new project, an evaluation must be made by experts in conjunction with the security team

Yes, a risk analysis is conducted in order to prevent new vulnerability or policy compliances issues

Yes, after the contract signature

I don't need if the budget is approved

No needs if it's open source

For all internal communications

Whenever information is transmitted or stored

Only for confidential information

Never, it is too costly

It's just a delivery man, we can leave him alone the package must be important.

Don't let unknown people in without an access badge. Ask them who they have an appointment with and inform the office manager, without letting them in alone.

Be polite and hold the door open for visitors.

Make appointments with your suppliers or service providers at the office, without having to be physically present to meet them.