50 controls insurers and security guidance commonly ask about, in 8 groups. 15 of them cite a CISA Cross-Sector Cybersecurity Performance Goal by code and official title.
Each control shows the question as an insurance application would ask it, what it means in plain terms, the CISA goal it maps to (where the app cites one) and a weight from 1 to 3. The weight is how much the app counts the control when it scores readiness: heavier controls move the score more.
The question: Is multi-factor authentication (MFA) enforced on every company email account?
Every login to company email requires a second factor (an app code, a hardware key, a push approval) in addition to a password, for every user, with no exceptions.
CISA CPG 2.0: 3.F Implement Multifactor Authentication (MFA). CISA's CPG page
Also referenced: FBI IC3 Internet Crime Report, BEC section.
Why it is asked. Compromised email is the single most common entry point insurers see for both business email compromise (wire-fraud) and ransomware claims - a stolen password alone should not be enough to get in.
The question: Is MFA required for all remote access into company systems (VPN, remote desktop tools, cloud admin consoles)?
Any way an employee (or an attacker) can reach internal systems from outside the office requires MFA, not just a username and password.
CISA CPG 2.0: 3.F Implement Multifactor Authentication (MFA). CISA's CPG page
Also referenced: NIST Cybersecurity Framework 2.0, Protect (PR.AA-03).
Why it is asked. Remote access without MFA is one of the most frequently cited gaps in ransomware claim investigations - it is a direct path from a stolen password to full network access.
The question: Do domain admin, IT admin, and other privileged accounts specifically require MFA?
Accounts with elevated permissions (able to change security settings, access all data, or manage other users) have MFA enforced, even if the organization has not rolled it out to every account yet.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 6 (Access Control Management).
Why it is asked. A privileged account is the highest-value target for an attacker - compromising one can undo every other control on this list at once.
The question: Does every administrator use their own named account rather than a shared/generic admin login?
Nobody logs in as a generic "admin" account that multiple people know the password to; every admin action is traceable to one named person.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 5 (Account Management).
Why it is asked. Shared credentials make it impossible to tell who did what during an incident, and they are far more likely to leak (written down, reused, left with a departed employee).
The question: Is there an enforced password policy requiring long, unique passwords (and is password reuse across accounts prevented)?
Passwords are required to meet a real minimum length, are not reused across accounts, and service/machine accounts have their own unique passwords distinct from any person’s login.
CISA CPG 2.0: 3.B Establish Minimum Password Strength. CISA's CPG page
Also referenced: CIS Critical Security Controls v8, Control 5.
Why it is asked. Weak or reused passwords are a routine way a single leaked credential (from an unrelated breach elsewhere) turns into access to your systems, independent of whether MFA is in place everywhere yet.
The question: Is access limited to what each role actually needs, and revoked promptly when someone leaves or changes roles?
People have access to only the systems and data their job requires, and that access is removed on their last day, not weeks later.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Protect (PR.AA-05); CIS Controls v8, Control 5.
Why it is asked. Over-provisioned or stale access widens the blast radius of any single compromised account and is a common finding after an insider or departed-employee incident.
The question: Have the default/vendor-supplied passwords been changed on all devices, accounts, and software (routers, firewalls, cameras, admin consoles)?
Nothing on the network is still running with the password it shipped with from the manufacturer; every built-in or default account has had its password changed to a strong, unique one (or been disabled).
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 4 (Secure Configuration) and Control 5 (Account Management).
Why it is asked. Default credentials are published, widely known, and among the first things automated attacks try - a device still using its factory password is effectively unlocked from the internet.
The question: Do accounts lock (or alert) after repeated failed login attempts, to slow down password-guessing attacks?
After a number of wrong password attempts an account is temporarily locked or the attempt is flagged, so an attacker cannot simply try thousands of passwords against a login unnoticed.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 6 (Access Control Management) and Control 8 (Audit Log Management).
Why it is asked. Automated brute-force and password-spraying attacks rely on being able to guess repeatedly and silently; a lockout or alert threshold turns that from an easy win into a noisy, detectable one.
The question: Do workstations and laptops automatically lock the screen after a short period of inactivity, requiring the password to return?
Devices lock themselves after a few idle minutes so an unattended, unlocked machine - in an office, a coffee shop, a home - is not left open to anyone who walks up to it.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 4 (Secure Configuration of Enterprise Assets and Software).
Why it is asked. An unlocked, unattended device bypasses every login control you have; automatic session locking is a cheap, standard baseline that closes that everyday gap.
The question: Do everyday user accounts run without local administrator rights on their own machines (admin rights granted only when specifically needed)?
People do their normal work in a standard (non-admin) account; installing software or changing system settings requires a separate elevation step, rather than every user being a full administrator of their own computer all day.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 5 (Account Management); NIST Cybersecurity Framework 2.0, Protect (PR.AA-05).
Why it is asked. When a standard user is also a local admin, malware that lands in their session inherits full control of the machine - removing standing admin rights sharply limits what a single compromised login can do.
The question: Is Endpoint Detection & Response (EDR) or an equivalent modern tool deployed on all workstations and servers?
A monitoring agent runs on every computer and server that can detect and often automatically stop malicious activity, not just signature-based antivirus.
CISA CPG 2.0: 4.A Establish Malicious Code Detection. CISA's CPG page
Also referenced: CIS Critical Security Controls v8, Control 10.
Why it is asked. EDR is now one of the most commonly required controls for binding a cyber policy at all - it is what typically catches ransomware in progress rather than after the fact.
The question: Is there a defined, followed timeline for applying security patches (especially critical/high-severity ones)?
The organization has an actual target - e.g. critical patches within a set number of days - and can show patches going out on that schedule, not an ad-hoc "whenever."
CISA CPG 2.0: 2.B Mitigate Known Vulnerabilities. CISA's CPG page
Also referenced: CIS Critical Security Controls v8, Control 7.
Why it is asked. Unpatched known vulnerabilities are one of the most common ways ransomware groups get initial access; insurers want evidence of a real cadence, not just intent.
The question: Are laptops and mobile devices that hold company data encrypted at the disk level (e.g. BitLocker, FileVault)?
If a laptop is lost or stolen, its data cannot be read without the device password/key, because the whole disk is encrypted.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Protect (PR.DS-01).
Why it is asked. Device loss/theft is a common, low-sophistication cause of a data-breach claim; disk encryption often turns a lost laptop from a reportable breach into a non-event.
The question: Are there any operating systems or critical software still in production past their vendor end-of-life/support date?
Every OS and critical application in use is still receiving security patches from its vendor; nothing is running on a version the vendor has stopped supporting.
CISA CPG 2.0: 2.A Manage Organizational Assets. CISA's CPG page
Why it is asked. An unsupported system can never be patched against newly discovered vulnerabilities, which makes it a standing, unfixable weak point.
The question: Is there a maintained inventory of the devices (computers, servers, network gear) and software actually in use across the business?
The organization keeps an up-to-date list of the hardware connected to its network and the software installed on it - so it knows what it is actually responsible for protecting, patching, and watching.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 1 (Inventory and Control of Enterprise Assets) and Control 2 (Inventory and Control of Software Assets); NIST Cybersecurity Framework 2.0, Identify (ID.AM-01, ID.AM-02).
Why it is asked. You cannot protect, patch, or detect a compromise on a device or application you do not know exists; an accurate inventory is the foundation nearly every other control depends on.
The question: Are devices and software set up from a secure baseline - unnecessary services, ports, and features turned off - rather than left at default settings?
Machines and applications are configured to a hardened standard (a documented baseline), with default sample accounts, unused services, and unnecessary open ports disabled, rather than run however they came out of the box.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 4 (Secure Configuration of Enterprise Assets and Software); NIST Cybersecurity Framework 2.0, Protect (PR.PS-01).
Why it is asked. Default configurations are built for easy setup, not security; leftover services and open ports are exactly the loose ends attackers probe for, and a consistent baseline removes them everywhere at once.
The question: Is there control over which software is allowed to run on company machines, rather than any program being free to execute?
The organization limits what can run - either by explicitly allowing only approved applications, or at minimum by controlling and reviewing what gets installed - so unknown or unauthorized programs do not simply execute.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 2 (Inventory and Control of Software Assets); NIST Cybersecurity Framework 2.0, Protect (PR.PS-05).
Why it is asked. Ransomware and other malware are, ultimately, unauthorized programs running; controlling what is allowed to execute stops a whole class of attacks before an endpoint tool even has to detect them.
The question: Are phones, tablets, and laptops that access company data managed (enrolled in an MDM/device-management tool with security policies enforced)?
Devices that reach company email or data - including personal phones used for work - are enrolled in a management tool that can enforce a passcode, encryption, and, if the device is lost, remotely wipe company data.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 4 (Secure Configuration of Enterprise Assets and Software); NIST Cybersecurity Framework 2.0, Protect (PR.PS-01).
Why it is asked. Lost or stolen mobile devices and unmanaged personal devices are a common, low-sophistication route to company data; centralized management lets the business enforce baseline protections and cut off a device that goes missing.
The question: Do backups include a copy that is offline, air-gapped, or immutable, so ransomware on the network cannot reach and encrypt it too?
At least one backup copy cannot be modified or deleted by anything running on the regular network - either because it is physically disconnected or because it is stored in a write-once/immutable mode.
CISA CPG 2.0: 3.O Maintain System Backups & Restoration Ability. CISA's CPG page
Also referenced: CIS Critical Security Controls v8, Control 11.
Why it is asked. Modern ransomware actively hunts for and encrypts or deletes connected backups first; a backup an attacker can also destroy is not a real recovery path, and this is one of the single highest-weighted controls insurers screen for.
The question: Are backups periodically tested by actually restoring data, not just confirmed to have run?
On a defined schedule, someone actually restores a real file, system, or environment from backup and confirms it works - a backup job "completing successfully" every night is not the same thing.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Recover (RC.RP-01).
Why it is asked. A large share of failed disaster recoveries are discovered only during a real incident, when it is too late - insurers want proof recovery actually works.
The question: Are recovery time objective (RTO) and recovery point objective (RPO) documented for critical systems?
For each critical system, there is a written answer to "how long can this be down" (RTO) and "how much data can we afford to lose" (RPO) - the numbers that actually drive backup frequency and recovery priority.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Recover (RC.RP).
Why it is asked. Without documented objectives, "we have backups" doesn’t tell an insurer whether recovery would actually meet the business’s real tolerance for downtime or data loss.
The question: Are backups encrypted, both in transit to the backup destination and at rest once stored?
A stolen or accessed backup copy is unreadable without the encryption key - encryption applies both while the backup is being transferred and while it sits in storage.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Protect (PR.DS-01/02).
Why it is asked. Backups often contain a full copy of sensitive data; an unencrypted backup that leaks is functionally the same size breach as the live system.
The question: Is there email filtering beyond a basic spam filter - one that specifically targets phishing, malicious attachments, and links?
Inbound email is screened by a tool built to catch phishing and malware specifically (link rewriting/sandboxing, attachment detonation), not just bulk-spam filtering.
CISA CPG 2.0: 3.L Enable Email Security. CISA's CPG page
Also referenced: FBI IC3 Internet Crime Report, phishing statistics.
Why it is asked. Phishing remains the top reported entry vector in FBI IC3’s annual data; a purpose-built filter meaningfully reduces how many malicious emails ever reach an employee.
The question: Are SPF, DKIM, and DMARC configured for every company email-sending domain?
These are DNS records that let receiving mail servers verify an email claiming to be from your domain is actually authorized, and tell them what to do if it isn’t.
CISA CPG 2.0: 3.L Enable Email Security. CISA's CPG page
Why it is asked. Without DMARC, attackers can spoof your own domain to phish your customers or partners - a reputational and liability exposure, not just an internal one.
The question: Do all employees receive regular security-awareness training (at least annually)?
Every employee, not just IT staff, gets periodic training on recognizing phishing, social engineering, and safe handling of company data and credentials.
CISA CPG 2.0: 3.J Implement Cybersecurity Training. CISA's CPG page
Also referenced: NIST Cybersecurity Framework 2.0, Protect (PR.AT).
Why it is asked. Human error is a leading factor in successful attacks; trained staff are measurably less likely to click a phishing link or fall for a wire-transfer scam.
The question: Are simulated phishing exercises run periodically to test and reinforce staff awareness?
The organization sends its own staff realistic-but-fake phishing emails on a regular cadence and tracks who clicks, then follows up with targeted training.
CISA CPG 2.0: 3.J Implement Cybersecurity Training. CISA's CPG page
Why it is asked. Simulations are the way to verify training is actually working, rather than just having happened once.
The question: Is web traffic filtered (for example DNS filtering) to block known-malicious and risky websites before a browser can reach them?
When someone clicks a bad link or a piece of malware tries to phone home, a filtering layer blocks the connection to known-malicious or high-risk domains, rather than letting the browser or program connect freely.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 9 (Email and Web Browser Protections); NIST Cybersecurity Framework 2.0, Protect (PR.IR-01).
Why it is asked. Many attacks depend on a browser reaching a malicious site or malware reaching its command-and-control server; blocking those connections stops phishing-link and malware payloads even when a user has already clicked.
The question: Is a firewall in place at the network perimeter with a default-deny posture (only explicitly allowed traffic gets through)?
Traffic into the network is blocked by default; only specific, intentional exceptions are allowed through, rather than everything being open unless specifically blocked.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 12 (Network Infrastructure Management).
Why it is asked. A default-allow network is directly exposed to internet scanning and opportunistic attacks the moment any service is misconfigured.
The question: Is Remote Desktop Protocol (RDP) kept off the open internet - only reachable through a VPN, MFA-protected gateway, or jump host?
Nobody can reach a company machine’s remote-desktop port directly from the public internet; it is only reachable after first connecting through a protected gateway.
CISA CPG 2.0: 3.S Secure Internet-Facing Devices. CISA's CPG page
Also referenced: FBI/CISA joint ransomware advisories.
Why it is asked. Directly internet-exposed RDP is one of the single most common ransomware entry points found in claims - it is actively and automatically scanned for by attackers.
The question: Is the network segmented so that, e.g., guest/IoT devices and core business systems are not on the same flat network?
Different classes of device or sensitivity live on separate network segments, so a compromise on one segment doesn’t automatically reach every other system.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 12.
Why it is asked. A flat network lets an attacker who lands on one low-value device (a guest laptop, a smart TV) move laterally straight to critical systems.
The question: Are internet-facing systems regularly scanned for known vulnerabilities?
Anything reachable from the public internet (a website, a VPN gateway, a mail server) is periodically scanned by an automated tool that checks for known, unpatched vulnerabilities.
CISA CPG 2.0: 2.B Mitigate Known Vulnerabilities. CISA's CPG page
Also referenced: CIS Critical Security Controls v8, Control 7.
Why it is asked. Scanning is how you find the same weaknesses an attacker’s automated tools would find, before they do.
The question: Are public-facing web applications that handle sensitive data protected against common web attacks (e.g. a web application firewall, or a secure development/testing process)?
Any website or web app the business runs itself (not a third-party SaaS tool) that takes customer data or logins has protection against common attack patterns like SQL injection and cross-site scripting - either a web application firewall in front of it, or a real secure-development and testing process behind it.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 16 (Application Software Security).
Why it is asked. A vulnerable public-facing application is a direct, internet-reachable path to sensitive data that bypasses network perimeter controls entirely.
The question: Is network traffic monitored for intrusions and unusual activity (an IDS/IPS or equivalent network monitoring), not just filtered by a firewall?
Beyond blocking traffic at the firewall, something is actively watching network activity for the signs of an intrusion - unexpected connections, lateral movement, data leaving in bulk - and can alert on or block it.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 13 (Network Monitoring and Defense); NIST Cybersecurity Framework 2.0, Detect (DE.CM-01).
Why it is asked. Firewalls decide what is allowed in; monitoring is how you notice an attacker who is already inside. Faster detection is one of the largest factors in how much a breach ultimately costs.
The question: Is a penetration test performed periodically to actually attempt to find and exploit weaknesses, beyond automated vulnerability scanning?
On a defined cadence, a skilled tester (internal or hired) actively tries to break in the way an attacker would - chaining together weaknesses to see how far they can get - rather than only running an automated scan for known issues.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 18 (Penetration Testing); NIST Cybersecurity Framework 2.0, Identify (ID.RA-01).
Why it is asked. Scanning finds known, individual vulnerabilities; a penetration test shows whether they can actually be exploited together to reach sensitive systems, which is a more realistic measure of exposure.
The question: Is company Wi-Fi secured with modern encryption (WPA2/WPA3), with guest Wi-Fi kept separate from the business network?
Wireless networks use current encryption and strong keys (not open or outdated WEP/WPA), and visitors connect to a separate guest network that cannot reach internal business systems.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 12 (Network Infrastructure Management); NIST Cybersecurity Framework 2.0, Protect (PR.IR-01).
Why it is asked. A weakly secured or flat wireless network gives anyone within range - or any guest device - a foothold onto the business network without ever touching the firewall from the internet.
The question: Does the organization have a written incident response (IR) plan?
There is an actual document describing what to do when a security incident is suspected or confirmed - not an assumption that people will figure it out in the moment.
CISA CPG 2.0: 1.C Maintain Incident Response Plans. CISA's CPG page
Also referenced: NIST Cybersecurity Framework 2.0, Respond (RS.MA).
Why it is asked. Response speed and quality in the first hours of an incident materially affects both damage and claim cost; insurers want to see a plan exists before it’s needed.
The question: Has the incident response plan been tested or run through a tabletop exercise in the last 12 months?
The team has actually walked through a realistic scenario (e.g. "we just got a ransomware note") using the written plan, not just filed the document away.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Respond (RS.MA-01).
Why it is asked. An untested plan routinely turns out to have gaps (missing contacts, unclear authority to pay/not pay, no one who knows the actual backup restore steps) that only surface during a real incident otherwise.
The question: Does the IR plan name who to call - forensics firm, breach counsel, PR, the cyber insurer/broker - before an incident happens?
The plan lists actual names, firms, and phone numbers to call in the first hours, decided calmly in advance rather than looked up under pressure.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Respond (RS.CO).
Why it is asked. Many policies require using a pre-approved panel of forensics/legal vendors, and delay in engaging them can affect both the response and coverage.
The question: Does the plan require notifying the cyber insurer/broker at the start of a suspected incident, not after it’s resolved?
The very first steps of the plan include contacting the insurer’s claims line - many policies require notice before incurring response costs for those costs to be covered.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in General cyber-policy claims-reporting practice - confirm your specific policy’s notice clause with your broker.
Why it is asked. Late notification is one of the most common reasons a claim gets disputed; insurers want proof this is baked into the plan’s first steps, not an afterthought.
The question: Is there an inventory of where sensitive data (customer PII, payment data, health data, etc.) actually lives?
The organization can say, concretely, which systems and vendors hold sensitive data - not just "somewhere in our cloud."
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Identify (ID.AM-07).
Why it is asked. You cannot scope a breach, notify the right people, or protect the right systems if you don’t know where the sensitive data is in the first place.
The question: Is sensitive data encrypted in transit (e.g. TLS on every web/app connection that carries it)?
Data moving between systems, or between a user and a system, is encrypted the whole way, so it can’t be read if intercepted.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Protect (PR.DS-02).
Why it is asked. Unencrypted transit is a straightforward, well-understood way for sensitive data to be intercepted, and a routine finding insurers screen for.
The question: Is sensitive data encrypted at rest in the databases/storage where it lives?
Sensitive data sitting in a database or file store is encrypted, so a stolen disk or an unauthorized direct data-store access doesn’t expose it in plain form.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Protect (PR.DS-01).
Why it is asked. Encryption at rest is a standard baseline expectation and can also reduce breach-notification obligations in several state data-breach laws when data is unreadable.
The question: Are critical vendors/subprocessors (especially ones with access to your data or systems) reviewed for their own security posture?
Before and periodically after onboarding a vendor that touches company data or systems, someone actually checks their security practices - not just their price and features.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Govern (GV.SC).
Why it is asked. A large share of breaches originate through a third-party vendor rather than a direct attack - your exposure includes theirs.
The question: Is sensitive data kept only as long as it is actually needed and then securely disposed of, rather than retained indefinitely?
The business holds sensitive data only while there is a real reason to, and when data or a device is no longer needed it is securely destroyed (wiped, shredded) - old records and decommissioned drives are not just left sitting around.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 3 (Data Protection).
Why it is asked. Every record you still hold is a record that can be stolen; data you no longer keep cannot be part of a breach, so minimizing and disposing of stale data directly shrinks the size of any incident.
The question: Do contracts with vendors that hold your data require them to notify you promptly if they suffer a breach affecting it?
Agreements with vendors and subprocessors that store or process company/customer data include a clause obligating them to tell you, within a set time, if their systems are breached in a way that touches your data.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Govern (GV.SC); CIS Critical Security Controls v8, Control 15 (Service Provider Management).
Why it is asked. A large share of breaches reach a business through a vendor; if the vendor is not contractually bound to tell you quickly, you can miss legal notification deadlines and discover the incident far too late.
The question: Does the organization have a written information security policy distributed to staff?
There is an actual document setting expectations - acceptable use, password requirements, data handling, reporting obligations - that employees have received and acknowledged.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Govern (GV.PO).
Why it is asked. A written policy is the baseline evidence that security expectations are a real organizational standard, not an informal habit that varies by team.
The question: Are logs from critical systems centrally collected and actively monitored (a SIEM or equivalent), not just stored locally?
Security-relevant logs (logins, admin actions, alerts) from important systems flow into one place someone actually watches or that generates alerts, rather than sitting unreviewed on each individual machine.
CISA CPG 2.0: 3.Q Maintain Log Collection & Storage. CISA's CPG page
Also referenced: CIS Critical Security Controls v8, Control 8.
Why it is asked. Detection speed is one of the biggest cost drivers in a breach - the longer an intrusion goes unnoticed, the more it typically costs to remediate.
The question: Is there a documented process that revokes a departing employee’s access the same day they leave?
Offboarding is a checklist, not a memory - it lists every system to disable access to, and it happens on the employee’s last day, every time.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in CIS Critical Security Controls v8, Control 5; NIST Cybersecurity Framework 2.0, Protect (PR.AA-05).
Why it is asked. Former-employee accounts left active are a recurring, entirely preventable cause of unauthorized access incidents.
The question: Is there a specific person (or role) formally responsible and accountable for cybersecurity, rather than it being nobody’s clear job?
Someone is named as responsible for security decisions and for making sure controls actually get done - it is a defined role, even if part-time or outsourced, not an assumption that "IT" or "the owner" handles it informally.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Govern (GV.RR-02).
Why it is asked. When no one owns security, controls quietly lapse and incidents have no clear decision-maker; a named owner is the baseline evidence that security is actively managed rather than left to chance.
The question: Does the business periodically assess its cybersecurity risks (what could go wrong, how likely, how bad) rather than only reacting after something happens?
On a recurring basis, the organization steps back and identifies its biggest cyber risks - which systems and data matter most, what threats they face, where the weaknesses are - and uses that to decide where to focus effort and spend.
CISA CPG 2.0: the app cites no CPG goal for this control. It is grounded in NIST Cybersecurity Framework 2.0, Identify (ID.RA-01).
Why it is asked. A risk assessment is how a business prioritizes limited resources on the controls that matter most for its situation; its absence usually means security is ad hoc and driven by whatever went wrong last.
11 of CISA's 34 CPG 2.0 goals are cited by at least one control above. CISA's full set has many more; this checklist is a small-business subset, not a replacement for the report.
| Goal | Official title (CPG 2.0 report) | Controls citing it |
|---|---|---|
| 1.C | Maintain Incident Response Plans | 1 |
| 2.A | Manage Organizational Assets | 1 |
| 2.B | Mitigate Known Vulnerabilities | 2 |
| 3.B | Establish Minimum Password Strength | 1 |
| 3.F | Implement Multifactor Authentication (MFA) | 2 |
| 3.J | Implement Cybersecurity Training | 2 |
| 3.L | Enable Email Security | 2 |
| 3.O | Maintain System Backups & Restoration Ability | 1 |
| 3.Q | Maintain Log Collection & Storage | 1 |
| 3.S | Secure Internet-Facing Devices | 1 |
| 4.A | Establish Malicious Code Detection | 1 |
PolicyReady is an app that walks a small business through these same controls, ranks the gaps and exports a readiness summary. This page is a free, no-signup version of the idea; nothing here is sent anywhere.
PolicyReady is not released. It is in App Store review as of 2026-10-13, so you cannot install it yet. This page works now and does not need it.