1.Has your organization appointed a Chief Information Security Officer (CISO)?

2.Is there a formalized Information Security Policy (ISP) approved by management?

3.Does an IS security committee meet regularly?

4.Do you have an up-to-date inventory of your IT assets (servers, workstations, applications)?

5.Are sensitive data classified according to their criticality level?

6.Is encryption applied to sensitive data (at rest and in transit)?

7.Are accesses to critical systems logged and monitored?

8.Are penetration tests performed periodically?

9.Is a security incident management plan documented and tested?

10.Is a Business Continuity Plan (BCP) in place?

11.Are your personal data processing activities declared to the CNDP?

12.Have you performed a DGSSI/DNSSI compliance audit?