Answer for the devices, accounts and services covered by this assessment, including remote work and applicable personal devices. “Yes” means every applicable check in the description is in place. Choose “Not sure” when evidence is missing; use “Not applicable” only when its stated reason is true. This questionnaire does not inspect your systems.

Question 1 of 110% Complete
Risk Area: Awareness and training

Do staff receive role-relevant guidance on email, SMS, QR and phone scams?

Use onboarding and useful refreshers. Optional supportive simulations should have clear aims; a quarterly frequency is not a CE requirement or proof that staff will detect all attacks.