CAMS Lite

Get Your FREE Cyber Health Check

Gain Insight into whether your company has adequate controls, is prepared for consequences, and can recover from threats.

Start Questionnaire Learn More

About CAMS Lite

Assess Your Cyber Resilience

Are you confident that your business is protected against cyber threats? Our free Cyber Assurance Management System (CAMS) Lite assessment helps you find out. Answer ten simple cyber control questions and get a personalised report sent straight to your inbox.

Discover how well your business is prepared to prevent cyber attacks and get expert guidance on how to strengthen your defences.

It's quick, easy, and could save your business. Take the first step to better cyber security today.

Learn How Prepared You Are Against Cyber Threats

Our FREE Cyber Health Report assesses how prepared your business is to protect itself against evolving cyber threats.

Are you sure adequate and appropriate controls are in place?

Are you prepared for the consequences?

Are you defending your company from the threats you face?

Could you recover?

Are you, your Board and your Company compliant, and meeting your Duty of Care?

Take the First Step to Better Cyber Security

Get your personalised report sent straight to your inbox completely free of charge, with no strings attached.

Start Questionnaire

Instant Insights, Zero Commitments

Get a personalised Cyber Health Report delivered to your inbox within minutes, no strings attached.

Quick & Easy To Complete

Our streamlined questionnaire takes just a few minutes to complete, making it simple to assess how well prepared your business is to prevent cyber attacks.

Expert Guidance From Top Cyber Security Experts

Uncover potential vulnerabilities and receive actionable advice on strengthening your cyber defences.

Please Complete our CAMS Lite Questionnaire

Gain Insight into whether your company has adequate controls, is prepared for consequences, and can recover from threats.

Start Questionnaire

Completely free, no strings attached

Delivered to your inbox within minutes

Expert Guidance From Top Cyber Security Experts

Govern

1.

Has a senior executive been appointed who is accountable for the oversight and delivery of cyber security within the organisation?

A senior executive (e.g., COO, CIO) has been appointed who is accountable for the oversight and delivery of cyber security and the assignment of associated roles and responsibilities. This is either their dedicated role or a significant proportion of their role.

A senior executive has been appointed who is accountable for the oversight and delivery of cyber security and the assignment of associated roles and responsibilities. However, this is not their dedicated role or a significant proportion of their role.

Someone (not a senior executive) within the organisation has been appointed and is accountable for the oversight and delivery of cyber security and the assignment of associated roles and responsibilities. There are plans to appoint a senior executive in the future.

No-one has been appointed to be accountable for the oversight and delivery of cyber security.

Govern

2.

Is your Board / Management team provided data to inform security risk management decisions; how well threats are being identified and managed, how well controls are working, and how far away you are from the target risk appetite?

Senior executives review information related to cyber risks at least quarterly, including threat identification, control implementation and operation, and the performance of the security risk management function as a whole. This information is used to support the discussion of cyber and relevant decision-making.

At least one senior executive reviews cyber risk information at least quarterly, how well threats are being identified and managed, how well controls are working, and including the performance of the security function as a whole. This information is used to support the discussion of cyber and relevant decision-making.

Non-executives, such as technology or operational leads, review some information related to cyber security measures. The information is used to support relevant decision-making.

Information related to cyber security measures are not regularly reviewed.

Govern

3.

Do you have sufficient control and oversight of your supply chain?

All outsourcing and third party providers are risk assessed, and minimum requirements for security are set. There are a combination of measures (e.g., contractual, monitoring, ongoing engagement, data protection, auditing etc.) in place to validate adherence to security requirements.

For all critical outsourcing and third party arrangements, clear risk assessments and minimum security requirements are set. There are a combination of measures in place to validate adherence to security requirements; the organisation does not solely rely on contractual provisions with the third party.

All outsourcing and third party providers are subject to a standardised procurement process with minimal or no security considerations. Monitoring, where it occurs, does not consider usually security.

There is no control and/or oversight of the supply chain.

Identify

4.

Do you proactively inventory all information assets (operating systems, applications, servers, network devices), identify relevant security vulnerabilities, and patch them using a risk prioritised methodology?

Information assets (hardware, devices, data, personnel, and software) are identified, prioritised, and documented in an inventory on an ongoing basis. Assets are scanned for vulnerabilities on an on-going basis and patches are applied in a defined timeframe.

Information assets and systems are identified, prioritised, and documented in single/multiple inventories which are reviewed at set intervals. Vulnerability scanning takes place on at least a monthly basis, and patches applied or the risk formally accepted.

Information assets and systems are identified, prioritised, and documented, and these are reviewed on an ad-hoc/infrequent basis. There are inconsistent vulnerability scanning and patching processes.

Information assets and systems have not been formally identified, prioritised and documented. There is no consistent vulnerability identification or patching process in place.

Protect

5.

Does all remote access to the corporate network and business applications require strong authentication?

All remote access to the corporate network, business applications and data (including 3rd party online services) requires at least two-factor authentication for non-privileged and privileged users.

Remote access to the majority of corporate network, business applications and data requires at least two-factor authentication.

Remote access for a limited / selected number of corporate network, business applications and data requires at least two-factor authentication.

Remote access to the majority of corporate network, business applications and data does not require multi-factor authentication.

Protect

6.

Are privileged rights understood, documented and reviewed in terms of assignment to system and user accounts?

Dedicated privileged accounts exist, and are used to separate and segregate 'normal' user accounts activity where individuals' (including third parties) privileged and/or high-risk credentials are centrally managed, monitored, and have additional security measures. The individuals, their documented rights, their duties, and their logged activities are independently monitored and reviewed on an ongoing basis to ensure they are appropriate and still required.

Dedicated privileged accounts exist, and are used to separate and segregate 'normal' user accounts activity where individuals' (including third parties) privileged and/or high-risk account credentials are centrally documented. Access privileges and permissions are independently monitored and reviewed at regular time intervals to ensure they are appropriate and still required.

Individuals' privileged and/or high-risk rights are centrally understood and enforced as part of a joiners-movers-leavers process. Reviews of the on-going requirement for the privileges are conducted on an ad-hoc/infrequent basis.

There is no centralised view of individuals' privileged or high/risk credentials or their assignment.

Protect

7.

Are applications in use by the company restricted to those that been approved by management, and are configured to enforce security?

Only applications that have been approved by management are used by staff and are configured to prevent the use of unapproved / malicious programs. Microsoft Office Macros that originate from the internet are blocked and unneeded features disabled, and web browsers are configured to block unwanted / insecure activity.

Only applications that have been approved by management are used by staff and are configured to prevent the use of unapproved / malicious programs. You uninstall and remove end of life, end of support software and services but not necessarily unauthorised and unnecessary software, services, and/or software components.

There is an ad hoc / inconsistent control of applications and software.

There is no direct management control of the use of applications and software.

Protect

8.

Do you monitor and adjust the security configuration of your email system to prevent and detect malicious activity?

The security of the use of email has been enhanced by only allowing approved attachment types, the analysis / sanitisation of hyperlinks, the central configuration of SPF, DMARC and DKIM, the enforcement of TLS encryption v1.3, enablement of Microsoft 365 message encryption (or similar), enablement of a Data Loss Prevention (DLP) capability, the blocking of auto forwarding to external domains, implementation of warning tags for external email and enabling (where applicable) pre-set security policies in Microsoft 365 Defender.

You have not taken steps to enhance the configuration of your email security.

Recover

9.

To what extent have you identified and assessed the cyber risk within your important business services?

All important business services and their underlying people, processes, and technology are dynamically assessed to identify areas or sources of cyber risk. These risks are monitored, assessed, and prioritised to reflect the current threat landscape, relevant changes (e.g., M&A activity, major out- or in-sourcing, business delivery model etc.) to the service(s), and the effectiveness of current internal controls. Cyber risks are integrated into the enterprise risk management framework.

All important business services and their underlying people, processes, and technology are regularly assessed to identify areas or sources of cyber risk against the current threat landscape and internal controls reviewed and updated at set intervals.

Reviews of important business services are underway to identify areas or sources of cyber risk, or such reviews have occurred but are not systematically run.

There is no identification of cyber risks within important business services.

Recover

10.

Do you have secure backups of data and information that would be needed to recover the operations of your business services and could be accessed during an incident?

All data are synchronistically backed up, to ensure a common restoration point, and encrypted in line with business requirements, (including by at least one format that does not require continuous access to the network) and are retained in a secure and resilient manner. Only privileged accounts can access backups, and integrity checks validate the readiness of all critical business service backups for use.

All data are synchronistically backed up, to ensure a common restoration point, in line with business requirements. Backups are retained in a secure and resilient manner, and integrity checks validate the readiness of most or all important business service backups for use.

Critical data are backed up, and backups are hardened against damage or deletion.

Data are not or are inconsistently backed up.

Your Details

11.

Please provide your contact details so that we can follow-up and share your CAMS Lite Questionnaire results with you.

We won’t use your contact details to contact you for any other reason, as we provide your CAMS Lite Report with no strings attached.

If you want to learn more about how we can support your business, please get in touch with us directly.

Name*

Email*

Company Name

Phone

Submit Your Answers

Your responses will be assessed by our purpose-built automated platform and you will receive an email within minutes with your full report on how well your business is prepared to prevent against cyber threats and how to respond to them.

Completely free, no strings attached

Delivered to your inbox within minutes

Expert Guidance From Top Cyber Security Experts

Thank You for Completing the CAMS Lite Questionnaire!

We will be in touch soon with your results.

Learn More About Us

Oops! Something went wrong while submitting the form.

Get In Touch

Get in touch using the contact form or directly using our contact details below.

Call us today

+44 (0) 20 7460 0426

Send us an email

info@digitaloversight.ai

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.