Évaluation du risque cyber : score d'exposition à la fraude
Answer 24 questions across financial processes, people, vendors, identity, data and incident response to get your Fraud Intelligence Score and a 30/60/90-day action plan.
Finance processes and payments
How the company approves, checks and releases payments and transfers.
- How is a change to a vendor's bank details validated?
- How many approvals do payments above a threshold need?
- What happens when the 'CEO' asks for an urgent, confidential transfer?
- How often are payments and statements reconciled?
Social engineering and people
How ready staff are to spot scams by email, phone and messaging apps.
- Does staff get scam-awareness training?
- Do you run phishing or scam simulations?
- Is there a simple channel to report a suspicious message?
- Are executives' details (phone, schedule, family) protected?
Third parties and vendors
Control over vendors that access data or systems or receive payments.
- Do you know which vendors access data or systems?
- Do vendor contracts include security and incident-notice clauses?
- Is vendor access reviewed and removed when the service ends?
- Do critical vendors get a security review before hiring?
Identity, access and MFA
Who can access what, with what protection, and what happens when someone leaves.
- Is MFA turned on for email, banking and critical systems?
- When someone leaves, is their access removed?
- Do shared passwords and generic accounts exist?
- Are administrator rights limited?
Data protection and backups
LGPD/GDPR compliance, data mapping and the ability to recover information.
- Do you know what personal data you handle and where it is?
- Is there a DPO and a channel for data subjects?
- Would your backups survive ransomware?
- Is old data deleted according to a policy?
Incident response and insurance
Plan for the first hours of an attack, mandatory notices and insurance cover.
- Is there an incident response plan?
- Does the company know incident notification deadlines (regulators, data subjects)?
- Do you have cyber insurance?
- Has the company run a tabletop exercise?