Self-assessment · APAC NREN Cyber Readiness

Nobody is specifically responsible for security at our organisation, and we don't have a written policySomeone handles it informally, but we don't have a management-approved policyWe have a named person responsible, and a policy approved by management that covers our legal and regulatory obligationsOur board has approved a policy with a formal risk appetite statement, and senior management is accountable for itWe run a full Information Security Management System, reviewed regularly and audited externally

We haven't done a risk assessment, and there's no dedicated security budgetWe've done an informal or ad hoc risk review, and budget gets allocated case-by-caseWe have a documented risk assessment and an annual budget for securityWe have a formally approved risk strategy with a set review schedule and a way to coordinate across departments/sectorsWe monitor risk continuously, report it to the board, and formally assess third-party/supply-chain risk too

We don't track any KPIs, and there's no governance reportingWe track some metrics informally, but they don't get reported upwardWe have defined KPIs and report them to management on a set scheduleWe track KPIs, report them to the board, and use them to drive internal auditsOur governance is independently audited and certified on a recurring basis

NREN cybersecurity self-assessment

Governance & Policy