Risk Assessment Tool

Find out what cyber risks your business is exposed to, and receive a Tailored Action Plan to help deal with them.

Take 10 minutes to find out what cyber risks your business faces

Receive an Action Plan tailored to your business to help improve your cyber resilience

Make your business more resilient to cyber attack

Risk assessment

Are you the only employee in your business? (e.g., sole trader or limited company)

Risk Assessment Consent(Required)

Please tick here to indicate your consent.

I have read the information sheet entitled “Information for Participants: Risk Assessment Tool for SMEs” provided.
I understand I can contact cyber-resilience@cyberskills.ie to ask questions about the purpose and nature of the research study.
I understand that I have the right to refuse to participate, refuse to answer any question and withdraw up to the point of data analysis without any consequence.
I understand that the answers I give will be collected by the research team and used in their study.
I understand my data will be used in the development of the Risk Assessment Tool and it is planned to publish the anonymous findings in an academic journal.
I consent voluntarily to be a participant in this research study.

The business I own/ work for is operating in the Republic of Ireland.(Required)

Yes

This field is hidden when viewing the form

Are you the only employee in your business? (e.g., sole trader or limited company)(Required)

Yes

What sector does your business operate in?(Required)

Who is responsible for the cybersecurity of the business?(Required)

No one

Myself

An outsourced person/team

Other

What is the outsourced person/team responsible for?

IT only

Cybersecurity only

IT and Cybersecurity

Not sure

Has someone been assigned the responsibility of maintaining network security to ensure there is no unauthorised access or usage? (E.g., maintenance of network firewalls)

Yes

Not sure

Does the business have cyber insurance?

Yes

Not sure

Does the business currently meet the minimum cybersecurity requirements for the cyber insurance policy?

Yes

Not sure

Does the business rely on a Social Media Platform (such as Facebook or Instagram) to sell your products and/or services?

Yes

Can customers make purchases on the business website?

Yes

The business has a website but customers cannot make purchases on it

The business does not have a website

How does the business take payments on its website?

The business processes card details directly

The business uses a third-party payment provider (such as Stripe, PayPal, Apple Pay, Google Pay)

The business uses a combination of the first two options

Not sure

Does the business currently comply with Payment Card Industry (PCI) standards?

Yes

Not sure

Is the cybersecurity of the business website managed by a suitably qualified person on an ongoing basis?

Yes

Not sure

Is the business website backed up?

Yes

Not sure

Is an inventory maintained of all the digital hardware used in the business? (a document that lists all business computers, mobile phones, printers, routers, etc.)

Yes, a comprehensive hardware inventory is maintained and updated regularly

Somewhat – a hardware inventory is maintained but it may not be up-to-date

No, a hardware inventory is not maintained

Is an inventory maintained of all the software used in the business? (a document that lists the software, such as Microsoft 365, Google Docs, accounting and sales software, etc.)

Yes, a comprehensive software inventory is maintained and updated regularly

Somewhat – a software inventory is maintained but it may not be up-to-date

No, a software inventory is not maintained

Do you use your own personal device (mobile phone, computer, etc) for the business? (e.g., accessing files, emails etc)

Yes

Do you have full access to business files when using your personal device?

Yes

Not sure

Do you use a VPN when working remotely?

Yes

I don’t know what a VPN is

We don’t work remotely

Do you have antivirus and/or endpoint management on your devices?

Yes, on all devices

Yes, on some devices

No, not on any devices

Not sure

Are work devices wiped of all data when they are no longer being used for the business?

Yes

I have not needed to do this yet

Not sure

How do you keep the software on your devices up to date?

I manually update all the software

I have automatic updates enabled for all the software

All software is updated regularly – using either manual or automated updates

A mix – some of the software is automatically updated and I manually update the remainder

An outsourced third party updates the software

The software is not regularly updated

Not sure

What type of data does your business collect? Tick all that apply:

Personal data (emails, names, phone numbers)

Sensitive data (health-related data, data regarding customers race/ethnicity/sexual orientation)

Intellectual Property data (business sensitive data such as product design documents, recipes, etc)

The business collects data but I am not sure what type

The business does not collect data

Other

What type of data does your business collect?: Other

Are you aware of your obligations under GDPR to report a personal data breach to the data Protection Commissioner within 72 hours of becoming aware of the breach?

Yes, I knew this already

I did not know this until now

Where is the data collected by the business stored? Tick all that apply:

In the Cloud (e.g., Microsoft 365, CRM or Finance Software)

On a work computer

On mobile devices

On paper

Not sure

Not applicable

Other

Where is the data collected by the business stored? : Other

Do you have a backup for the business data that is stored in the Cloud?

Yes, I pay for a dedicated cloud backup service

Yes, I download and back up the data locally

Not sure

I think the business data stored in the Cloud is backed up by the Cloud Provider but I’m not sure

Do you encrypt the data stored by the business?

Yes, I encrypt all data

Yes, I encrypt some data

No, I don’t encrypt any data

Not sure

Do you process customer payments over the phone?

Yes

How do you manage this data (the customers card numbers)?

The data is inputted directly into the payment device and is not written or stored anywhere

The data is stored in an encrypted file (e.g., password protected)

On paper

On a work computer

Not sure

Other

Do you share business data with any Third Parties (e.g., delivery drivers not directly hired by you, marketing agencies, or outsourced IT personnel)?

Yes, they get full access to the business systems

Yes, they get access to the business systems, but only as much as they need to complete their job

Yes, I share business data, but I do not give Third Parties direct access to the business systems (e.g. data is shared via email or Excel files)

How do you schedule data backups for critical data?

I have automated backups scheduled

I perform manual backups

Some of my backups are automated and some are manual

I don’t have a formal data backup process in place

How often do you complete a critical data back up?

Daily

Weekly

Monthly

Yearly

Ad hoc

Not sure

Do you have immutable or air-gapped backups for your business's critical data? (Immutable means 'read only'. Air-gapped means having no direct connection to the internet or to any other computer that is connected to the internet)

Yes, for all backups

Yes, for some backups

Not sure

Are your data backups tested? (this is where you check to see if you can recover your data)

Yes, they are tested monthly

Yes, they are tested annually

Yes, they are tested twice a year

Yes, but I have only tested them once

Not sure

Do you have Multi Factor Authentication (MFA)?

Yes, for all business critical applications

Yes, for some business critical applications

Not sure

Do your passwords have a minimum length of at least 16 characters?

Yes

Not sure

Do you use a Password Manager? (an app that stores all of your passwords)

Yes, for all my passwords

Yes, for some of my passwords

Not sure

Do you enforce block listing passwords? (this is where certain passwords are not allowed as they are too easy to guess)

Yes

Not sure

How often do you engage with cybersecurity training? 

Weekly

Monthly

Yearly

Ad Hoc

Never

Would you know what to do if a cyber incident occurs?

Yes, there is a plan in place

Not sure

Have you tested your incident response plan?

Yes, it is tested regularly and updated

Yes, once

No, it has never been tested

Do you have a business continuity plan (BCP) in place? (A BCP is a documented plan for how to prevent and recover from potential threats to a company such as fire, flood, cyber-attack)

Yes, and it is regularly tested, reviewed and updated

Yes, but it has only been tested once

Yes, but it has never been tested

Is your cyber incident plan integrated into your Business Continuity Plan (BCP)?

Yes

Not sure

Do you have a cybersecurity policy for your business?

Yes, I have a documented cybersecurity policy in place

Yes, I have a policy but it is not documented

Not sure

Name

This field is for validation purposes and should be left unchanged.

You are 0% done.

Risk Assessment Consent(Required)

Please tick here to indicate your consent.

The business I own/ work for is operating in the Republic of Ireland.(Required)

Yes

This field is hidden when viewing the form

Are you the only employee in your business? (e.g., sole trader or limited company)

Yes

How many employees are in your business? (including yourself and all part time and full time staff)(Required)

What sector does your business operate in?(Required)

Who is responsible for the cybersecurity of the business?

Myself

Dedicated cybersecurity person/team in house

An outsourced person/team

Managed by employee(s) on top of their official role(s)

No one

Other

Who is responsible for the cybersecurity of your business?: Other

What are the dedicated person/team responsible for?

IT only

Cybersecurity only

IT and cybersecurity

Not sure

What is the outsourced person/team responsible for?

IT only

Cybersecurity only

IT and Cybersecurity

Not sure

Has someone been assigned the responsibility of maintaining network security? (E.g. cybersecurity of routers, ports and/or maintenance of network firewalls)

Yes

Not sure

Does the business have cyber insurance?

Yes

Not sure

Does the business currently meet the minimum cybersecurity requirements for the cyber insurance policy?

Yes

Not sure

Does the business rely on a Social Media Platform (such as Facebook or Instagram) to sell products and/or services?

Yes

Can customers make purchases on the business website?

Yes

The business has a website but customers cannot make purchases on it

The business does not have a website

How does the business take payments on its website?

The business processes card details directly

The business uses a third-party payment provider (such as Stripe, PayPal, Apple Pay, Google Pay)

The business uses a combination of the first two options

Not sure

Does the business currently comply with Payment Card Industry (PCI) standards?

Yes

Not sure

Is the cybersecurity of the business website managed by a suitably qualified person on an ongoing basis?

Yes

Not sure

Is the business website backed up?

Yes

Not sure

Is an inventory maintained of all the digital hardware used in the business? (a document that lists all business computers, mobile phones, printers, routers, etc)

Yes, a comprehensive hardware inventory is maintained and updated regularly

Somewhat – a hardware inventory is maintained but it may not be up-to-date

No, a hardware inventory is not maintained

Is an inventory maintained of all the software used in the business? (a document that lists the software, such as Microsoft 365, Google Docs, accounting and sales software, etc.)

Yes, a comprehensive software inventory is maintained and updated regularly

Somewhat – a software inventory is maintained but it may not be up-to-date

No, a software inventory is not maintained

Do staff members use personal devices (e.g., mobile phones, computers) for work purposes?

Yes

Not sure

Do staff members have access to business files when using personal devices?

Yes

Not sure

Is a VPN required when staff connect remotely to the business (including 'working from home')?

Yes

I don’t know what a VPN is

We don’t work remotely

Does the business have antivirus and/or endpoint management on its devices?

Yes, on all devices

Yes, on some devices

No, not on any devices

Not sure

Are work devices wiped of all data when they are no longer being used for the business?

Yes

I have not needed to do this yet

Not sure

How is software kept up-to-date on business devices?

Software is manually updated

Automatic updates are enabled for all business software

All software is updated regularly – using either manual or automated updates

Not all of the business’s software is regularly updated – some is but some is not

The business relies on an outsourced third party to update its software

The business’s software is not regularly updated

Not sure

What type of data does the business collect? Tick all that apply:

Personal data (emails, names, phone numbers)

Sensitive data (health-related data, data regarding customers race/ethnicity/sexual orientation)

Intellectual Property data (business sensitive data such as product design documents, recipes, etc)

The business collects data, but I am not sure what type

The business does not collect data

Other

What type of data does your business collect? Tick all that apply: Other

Are you aware of your obligations under GDPR to report a personal data breach to the Data Protection Commission within 72 hours of becoming aware of the breach?

Yes, I knew this already

I did not know this until now

Where does the business store the data that it collects? Tick all that apply:

In the Cloud (e.g., Microsoft 365, CRM or Finance Software)

On a work computer

On mobile devices

On paper

Not sure

Not applicable

Other

Where does the business store the data that it collects?: Other

Does the business have a backup for data that is stored in the Cloud?

Yes, the business pays for a dedicated cloud backup service

Yes, the business downloads and backs up the data locally

I’m not sure

I think the business data stored in the Cloud is backed up by the Cloud Provider but I’m not sure

Does the business encrypt the data it stores?

Yes – all business data is encrypted

Yes – some business data is encrypted

No – no business data is encrypted

Not sure

Does the business process customer payments over the phone?

Yes

How does the business manage this data (the customers' card numbers)?

The data is inputted directly into the payment device and is not written or stored anywhere

The data is stored in an encrypted file (e.g., password protected)

On paper

On a work computer

Not sure

Other

Does the business grant access to its systems to any third parties (e.g., delivery drivers not directly hired by the business, marketing agencies, or outsourced IT personnel)?

Yes, third parties get full access to the business’s systems

Yes, third parties get access to the business’s systems, but only as much as needed to complete their job

Yes, the business shares data but does not grant third parties direct access to its systems (e.g., data is shared via email or Excel files)

How are data backups scheduled for the business's critical data sets?

Backups are scheduled to run automatically

Backups are performed manually

Some backups are automatic and others are performed manually

There is no formal data backup process in place

How often are backups completed for the critical data sets?

Daily

Weekly

Monthly

Yearly

Ad hoc

Not sure

Does the business have immutable or air-gapped backups for its critical data? (Immutable means 'read-only'. Air-gapped means having no direct connection to the internet or any other computer connected to the internet.)

Yes, for all backups

Yes, for some backups

Not sure

Are the business's data backups tested? (This refers to checking whether the business can recover its data)

Yes, they are tested monthly

Yes, they are tested annually

Yes, they are tested twice a year

Yes, but I have only tested them once

Not sure

Does the business enforce access controls so that different users have different access rights?

Yes

Not sure

Does the business have Multi-Factor Authentication (MFA) enabled?

Yes, for all business critical applications

Yes, for some business critical applications

Not sure

Do employees of the business share passwords with one another?

Yes, some passwords are shared

Yes, all passwords are shared

Are staff passwords required to have a minimum length of at least 16 characters?

Yes

Not sure

Are staff advised to use a password manager? (This is an app that stores all of their passwords)

Yes

Not sure

Does the business enforce blocklisting of certain passwords? (This is where certain passwords are not allowed because they are too easy to guess)

Yes

Not sure

How often do staff members engage in cybersecurity training?

Staff are required to engage with cybersecurity training once a month

Staff are required to engage with cybersecurity training once a year

Staff are informed about cybersecurity on an ad hoc basis, there is no formal training

Staff are required to engage with cybersecurity training upon hire, but not after that

Staff have never engaged with cybersecurity training

Are employees required to report any suspicious activities or cybersecurity incidents?

Yes, the business has clear reporting procedures for cybersecurity incidents

Somewhat, the business encourages reporting, but it’s not consistently enforced

No, the business does not have specific reporting procedures in place

Would staff members know what to do if a cyber incident occurs?

Yes, there is a plan in place that all staff are aware of

Yes, there is a plan in place, but only some staff are aware of it

Yes, there is a plan, but no staff are aware of it

Not sure

Has the business's Cyber Incident Response Plan been tested?

Yes, it is tested regularly and updated

Yes, once

No, it has never been tested

Does the business have a Business Continuity Plan (BCP) in place? (A BCP is a documented plan for how to prevent and recover from potential threats to a company, such as fire, flood, or cyber-attack)

Yes, and it is regularly tested, reviewed and updated

Yes, but it has only been tested once

Yes, but it has never been tested

Is the business's cyber incident plan integrated into its Business Continuity Plan (BCP)?

Yes

Not sure

Does the business have a cybersecurity policy?

Yes – there is a documented Cybersecurity Policy in place

Yes – the business has a Cybersecurity Policy but it is not documented

Not sure

Comments

This field is for validation purposes and should be left unchanged.