SETSEG

2022 Cyber Questionnaire

The information on this survey is required to renew your Property/Casualty coverage for the 2022-2023 policy year. Please answer the below questions based on the security measures in place as of today.

If you have any questions or need assistance while completing this form, please contact Paul Grienke, Insurance Education Specialist, at 517-816-1676 or pgrienke@setseg.org.

"*" indicates required fields

Employee Name*

Job Title*

District*

Email*

TRAINING

1. How often are email phishing tests conducted for all staff?

2. How often is cyber security awareness training conducted for all staff?

BACK-UP & RECOVERY

3. Are backups subject to the following measures?

4. Are your backups kept separate from your network ("offline") or in a cloud service designed for this purpose?

Yes

5. How frequently is critical information backed up? Pick one:

6. Does your district have the following business continuity plans in place?

7. If you conduct backups, how frequently is a recovery from a backup tested?

INTERNAL SECURITY

8. Is Multi-Factor Authentication (MFA) utilized for the following:

9. If Remote Desktop Protocol (RDP) is enabled, are the following protections implemented? Check all that apply. If RDP is NOT enabled, please skip this question.

10. How often do you apply security patches to your systems and install antivirus updates?

11. Do your users have local administrative rights on this laptop/desktop?

Yes

12. Does your district utilize an End-Point Protection (EPP) or End-Point Detection and Response (EDR) solution?

	Yes	No
EPP
EDR

If desired, provide commentary on what cyber security controls will be in place by July 1, 2022, that are not currently in place today.

Additional comments to expand on the answers above:

	Yes	No
Multi-factor authentication (MFA)
Encryption
Immutable
Virus/Malware scanning

	Yes	No
Disaster Recovery Plan
Business Continuity Plan
Incident Response Plan

	Yes	No
Virtual Private Network (VPN) for access
Multi-Factor Authentication (MFA) for access
Network level authentication enabled
Remote Desk Protocol honeypots

	Yes	No
Critical Systems (e.g. Finance, Human Resources, etc.)
Remote Access
Email