1) Have you identified the security official who is responsible?   

2) Have you implemented security awareness and training staff?   

3) Have you implemented workforce security policies and procedures for:

  Authorization or Supervision?  

  Workforce Clearance?    

  Termination Procedures?

4) Have you implemented:

  Security reminders for periodic security updates?

  Procedures for guarding against, detecting and reporting malicious software?

  Procedures for monitoring log-in attempts and reporting discrepancies?

Procedures for creating, changing, and safeguarding passwords?

5) Does your contingency plan address:

  Data back up plan?  

 Disaster recovery?  

  Emergency mode operation?

  Testing and revision procedure?     

  Applications and data critical analysis?

6) Have you established policies & procedures for workstation use? 

7) Do you have technical safeguards for access control that include:

  Unique user identifier?     Emergency access procedure?

  Automatic log off?       Encryption and decryption?

8) Do you have hardware, software and procedures for audit control? 

9) Have you implemented procedures to authenticate a person or entity?  

10) Do you have a well-orchestrated information technology infrastructure that can cost effectively address regulatory compliance?