2)  Do you have a firewall?*

3)  Do you force security and software updates?*

4)  Do you control access to your computer systems?*

5)  Do your access control procedures address access to critical or sensitive computer systems?*

6)  Do you have a person or group that is responsible for information security?*

7)  Do you have a program in place to periodically test your security controls?*

8)  Do you outsource any critical parts of your internal network/computer system or internet access?*

9)  Do you allow employees to download personal identifiable information (PII) of customers or others confidential information in your care onto laptops or other storage media?*

10)  Does your hiring process include criminal background checks?*

11)  Have you ever had a cyber incident (attack, breach, etc.)?*