Data Breach Preparedness Assessment Tool

Assess your organization's readiness for a data breach by answering the questions below. Each question evaluates a key aspect of breach response preparedness. Your score will reflect your organization's readiness level. Upon submission, a PDF report will be generated.

1. Insurance Engagement: Does your organization have cyber insurance, and is there a clear process for engaging with the insurer during a breach? Not Prepared: No cyber insurance or process in place Partially Prepared: Insurance exists, but no clear engagement process Prepared: Insurance and engagement process in place Prepared and Practised: Insurance and process in place, tested in drills

2. Legal Engagement: Is there a defined process for engaging legal counsel during a data breach? Not Prepared: No process for legal engagement Partially Prepared: Legal contacts identified, but no formal process Prepared: Formal legal engagement process established Prepared and Practised: Legal process established and tested in drills

3. Technical Response: Does your organization have a technical response plan for identifying, containing, and mitigating a data breach? Not Prepared: No technical response plan Partially Prepared: Basic plan exists, but incomplete or untested Prepared: Comprehensive technical response plan in place Prepared and Practised: Plan in place and tested in drills

4. ICO Reporting: Is there a process for reporting breaches to the Information Commissioner's Office (ICO) within 72 hours, as required by GDPR? Not Prepared: No ICO reporting process Partially Prepared: Awareness of ICO requirements, but no formal process Prepared: Formal ICO reporting process established Prepared and Practised: Process established and tested in drills

5. Late Enforcement Reporting: Is there a process to handle late reporting to enforcement authorities if the breach is discovered after the initial 72-hour window? Not Prepared: No process for late reporting Partially Prepared: Informal process or awareness, but not documented Prepared: Formal late reporting process in place Prepared and Practised: Process established and tested in drills

6. NCSC Reporting: Does your organization have a process for reporting incidents to the National Cyber Security Centre (NCSC)? Not Prepared: No NCSC reporting process Partially Prepared: Awareness of NCSC, but no formal process Prepared: Formal NCSC reporting process established Prepared and Practised: Process established and tested in drills

7. Intelligence Sharing: Does your organization participate in intelligence sharing with industry peers or authorities to improve breach response? Not Prepared: No intelligence sharing Partially Prepared: Informal sharing, but no structured process Prepared: Formal intelligence sharing process in place Prepared and Practised: Process established and tested in drills

8. Victim Communications: Is there a plan for communicating with affected individuals or organizations during a breach? Not Prepared: No communication plan Partially Prepared: Basic communication plan, but incomplete or untested Prepared: Comprehensive communication plan in place Prepared and Practised: Plan established and tested in drills

9. Supply Chain Engagement: Does your organization have a process for engaging with the supply chain during a breach? Not Prepared: No supply chain engagement process Partially Prepared: Informal engagement, but no formal process Prepared: Formal supply chain engagement process in place Prepared and Practised: Process established and tested in drills

10. Restoration of Supplier Access: Is there a process for safely restoring supplier access when suppliers are compromised? Not Prepared: No restoration process Partially Prepared: Informal restoration process, but not documented Prepared: Formal restoration process in place Prepared and Practised: Process established and tested in drills

11. Lessons Learned: Does your organization have a process for conducting post-incident reviews and implementing lessons learned? Not Prepared: No lessons learned process Partially Prepared: Informal reviews, but no formal process Prepared: Formal lessons learned process in place Prepared and Practised: Process established and tested in drills

12. Drills Conducted: Does your organization regularly conduct data breach response drills? Not Prepared: No drills conducted Partially Prepared: Drills conducted irregularly or incompletely Prepared: Drills conducted regularly Prepared and Practised: Drills conducted regularly with comprehensive scenarios

Submit Assessment