Information Security Assessment Questionnaire, SCUK Consulting

Welcome

Information Security Assessment

Approximately 20–25 minutes · No technical knowledge required

This questionnaire helps us understand how information security is managed across your organisation. There are no right or wrong answers, if you're unsure about anything, write "Not sure".

A few things to know before you begin:

This is not a formal audit or legal compliance review.
Where this assessment refers to legal or regulatory requirements, it considers selected UK and EU information security and data protection requirements only. It does not assess the laws or regulations of any other country, including the country in which your organisation is based. The security practices it reviews are general good practice and are not specific to any country.
Do not include names or personal details in your answers, describe situations and roles in general terms only.
Your responses are stored securely for up to 12 months, used solely for this assessment, and shared only with our AI provider (Anthropic) to help analyse your data, after which they are discarded. All reports are professionally reviewed by a qualified consultant before delivery.

I confirm I am authorised to share this organisation's information for this assessment, and I understand it will be processed securely by SCUK Consulting solely to prepare my report and other related work.

Section 1 of 12 · Organisation Overview

Information Security Assessment

About your organisation and the people involved.

Q1Organisation name

Q1aWhere is your organisation based?

Give the country where your organisation is registered or has its main office. If most of your work is somewhere else, still give the country you are based in. This is for our records and does not change what the assessment covers.

Q2What type of organisation are you?

Tick one, this helps us understand your regulatory context.

Q3Main contact for this assessment

Q4What does your organisation do?

Briefly describe your main services or activities.

Q5Who does your organisation provide products, services or support to?

Tick all that apply.

Q6Roughly how many people are involved in the organisation?

Group

Approximate number

Paid staff

Volunteers

Trustees / board members

Contractors / freelancers

Regular clients / customers

Section 2 of 12 · Types of Information

Information Security Assessment

Understanding what kinds of data your organisation holds.

Q7What types of information does your organisation handle?

Includes paper records, digital files, emails, databases, and verbal information. Tick all that apply.

Q8Which information would cause the most harm if lost, leaked, accidentally shared, or unavailable?

Q9Do staff or contractors handle sensitive information away from your main workplace?

For example on personal phones, home computers, while travelling or at a client site, in paper files, or via personal email.

Q10Is confidential information about your clients, customers or staff ever shared or stored in any of the following ways?

Tick all that apply, include formal and informal practices.

Q11Do you have written guidance covering how confidential information should be shared during day-to-day work, for example in team handovers, briefings or messaging groups?

Section 3 of 12 · Legal & Regulatory

Information Security Assessment

Your compliance obligations and regulatory context.

Q12Are you aware of any legal, regulatory, funder, commissioner, or contractual requirements that affect how you handle information?

Q13Which types of information you hold carry specific legal, professional, or sector confidentiality obligations?

Tick all that apply.

Q14Do customers, clients, regulators, insurers, funders, commissioners or partner organisations place information security or data protection requirements on you?

Q15Have you completed any cyber security, data protection, safeguarding, supplier, insurance, or due diligence questionnaires in the last 2 years?

Q16Are there any information-related obligations you are unsure about?

Q17Is your organisation registered with the Information Commissioner's Office (ICO)?

Most organisations that process personal data need to register. It costs £35/year for small organisations.

Q18Do you have a privacy notice explaining to people how you use their data?

Usually published on your website and given to clients when you first collect their information.

Q19Do you have a policy on how long you keep personal information before deleting or destroying it?

Q20Would you know what to do if a client, staff member, or volunteer asked to see the information you hold about them?

This is called a Subject Access Request (SAR). Organisations usually have 30 days to respond.

Q21Are you aware of the requirement to report certain personal data breaches to the ICO within 72 hours?

This applies when a breach is likely to result in a risk to people's rights and freedoms, for example a leak of sensitive client or customer records.

Q22Are there any compliance requirements you know about but do not yet have a clear policy, process, or procedure to meet?

Section 4 of 12 · Risk, Policies & Awareness

Information Security Assessment

Risk governance, policies, and the training that guides your team's behaviour.

Q23Does your organisation maintain an information asset register, a record of the key information assets you hold, who owns them, and how sensitive they are?

An information asset register is the foundation of good information security governance. It helps identify what needs protecting and by whom.

Q24Has your organisation carried out a formal information security risk assessment, identifying threats to your information assets and evaluating the likelihood and impact of those risks?

A risk assessment is required under ISO 27001 and recommended under UK GDPR. It helps prioritise where controls are most needed.

Q25Are there named individuals responsible for managing specific information security risks?

Risk ownership means specific people are accountable for ensuring agreed actions are taken to reduce identified risks.

Q26Has your organisation’s leadership formally agreed what level of information security risk is acceptable?

This is sometimes called a risk appetite or risk tolerance. It helps decision-makers understand what risks to accept, treat, or escalate.

Q27Does your organisation ever formally evaluate whether its information security arrangements are working effectively, with the aim of making improvements?

This might include management reviews, internal audits, post-incident reviews, or regular checks that controls are still appropriate. It maps to ISO 27001 Clause 9 (Performance Evaluation) and Clause 10 (Improvement).

Q28Which documents or guidance do you currently have?

Tick all that apply.

Q29Have staff or volunteers received any information security, cyber security, phishing, or data protection training?

Q30Are there any areas where staff are unsure what they should or should not do with information?

Section 5 of 12 · IT Support & Responsibilities

Information Security Assessment

Who manages your technology and information security.

Q31Who manages your IT?

Tick all that apply.

Q32Who should answer technical questions about systems, accounts, backups, devices, and security settings?

Q33Is there a written agreement or contract with your IT provider?

Q34Who is responsible for information security overall?

For example CEO, operations manager, trustee, data protection lead, IT provider.

Q35Is information security or cyber risk discussed by senior management or trustees?

Q36Is there a key person who holds most of the IT knowledge or system access, and what would happen if they were suddenly unavailable?

For example a volunteer who manages all passwords, or a staff member who is the only admin on all systems.

Q37Are devices and software kept up to date?

For example: are OS and software updates applied when available? Are any devices running unsupported software?

Section 6 of 12 · Access to Systems

Information Security Assessment

How people gain and lose access to your systems and data.

Q38How are new staff, volunteers, trustees, or contractors given access to systems?

Q39How is access removed when someone leaves or changes role?

Q40Is there a checklist or formal process for starters and leavers?

Q41Are access rights ever reviewed?

For example checking who still has access to email, shared drives, CRM, finance systems.

Q42Are shared accounts used?

For example one login used by several people.

Q43How is physical access to information managed?

Consider both access to the building (who can enter, visitor sign-in, locked areas, server or comms rooms) and access to information within it (paper records secured, screens visible to visitors, filing cabinets locked).

Q44Does your organisation hold sensitive information in paper or printed form?

For example client records, HR files, trustee papers, or finance documents.

Q45Are passwords and logins managed securely?

For example: strong/unique passwords, two-step verification (MFA), password manager in use.

Section 7 of 12 · Devices & Remote Working

Information Security Assessment

What hardware is used and where work happens.

Q46What devices are used for work?

Tick all that apply.

Q47Do staff, contractors or board members use personal devices for work?

Q48Do people work remotely or from home?

Q49Are there written rules or guidance for remote working?

Q50Are there written rules or guidance for the use of personal devices for work?

Section 8 of 12 · Suppliers & External Access

Information Security Assessment

Third parties who can access your systems or data.

Q51Which external suppliers or partners have access to your systems or information?

For example IT provider, CRM provider, payroll provider, accountant, website developer, local authority, funder.

Q52Do you know which suppliers can access sensitive information?

Q53Is there a process for approving new apps, platforms, or online tools before staff use them?

Q54Are staff allowed to use free online tools for work information?

For example free AI tools, file-sharing services, or online forms not approved by the organisation.

Q55If staff use AI tools (such as ChatGPT, Microsoft Copilot, or similar) as part of their work, have the associated risks been formally reviewed?

Consider: confidential data entered into AI tools, outputs used without verification, data retained by the tool provider.

Q56Is there written guidance for staff on what types of information should not be entered into AI tools or other external online tools?

Q57Do you share personal or sensitive information with partner organisations, referral agencies, or other external parties?

For example sharing client or customer records with contractors, referral agencies, health or care services, local authorities, or commercial partners.

Q58Does your organisation have cyber insurance?

Section 9 of 12 · Systems & Tools

Information Security Assessment

What technology your organisation relies on day-to-day.

Q59What systems or tools does your organisation use?

Select Yes / No / Not sure for each, and add names or details where known.

Q60Which systems are most critical to your day-to-day work, and what would happen if one became unavailable for several days?

Section 10 of 12 · Backups & Recovery

Information Security Assessment

Your resilience if something goes wrong.

Q61Do you know whether important files and systems are backed up?

Q62Has the organisation ever tested whether it can restore lost files or data?

Q63Who would be responsible for helping the organisation recover from a serious IT problem?

Section 11 of 12 · Incidents & Reporting

Information Security Assessment

Past security events and your reporting processes.

Q64Has the organisation experienced any of the following in the last 2 years?

Tick all that apply.

Q65Would staff know who to report a suspicious email, lost device, or data breach to?

Q66Is there a written incident or data breach procedure?

Q67Are incidents or near misses recorded anywhere?

Section 12 of 12 · Concerns & Priorities

Information Security Assessment

What you want to get out of this assessment, placed last so your answers are informed by the full questionnaire.

Q68What are your main concerns about information security, data protection, cyber risk, or IT resilience?

Q69Are there any known weaknesses you would particularly like this assessment to look at?

Q70What would be a useful outcome from this assessment?

Tick up to three.