Vulnerability Self-Assessment Test (VSAT)

Management Security
1	Does your organization have a Security Plan in place?
2	Has the Security Posture been evaluated within the last 12 months?
3	Does your organization have a Comprehensive Emergency Management Plan?
4	Are clear security policies and procedures in place?
5	Does your organization have dedicated Security Staff?
6	Do employees with security duties receive annual security training?
7	Does management support security efforts?
Physical/Technical Security
8	Does your organization have 100% accountability of all keys?
9	Is a balance Physical Protection System in place?
10	If an Electronic Security System is present, has it been testing in the last month?
11	Are Electronic Security Systems integrated?
12	Does your organization have the ‘As Builts’ for the Physical Protection System?
13	Is access controlled into your organization and/or satellite offices?
14	Has a security Risk Assessment been conducted in the past?
Information Security
15	Does your organization have an Information Protection Plan?
16	Is unneeded client Personally Identifiable Information (PII) purged?
17	Is access to Intellectual Property controlled?
18	Do your organization have onsite IT personnel?
19	Is access to server rooms controlled?
20	Does your organization generate audit trails for CPU usage?
Current Risk Level	Total: 0

*Brief Evaluation Purposes Only*

Low Risk	Moderate Risk	High Risk
0 – 5 points	10 – 45 points	50 – 100 points