We have defined the scope of our security management system.
We have assessed our information security risks this year.
We have a Statement of Applicability.
Our policies are approved by leadership.
We have completed an internal audit.
We have held a management review.
We assess the security of our suppliers.
We have tested our incident process.
Answer each line to see where you stand.