3 Section 3 – Assessment 3.1 Introduction 3.2 Description of an organisation’s tier level This section describes the steps to be taken in a periodic review of the completeness and effectiveness of the action that has been taken. The outcome of this review should be a statement about the maturity of the organisation’s own cybersecurity. It should permit a comparison within a given sector, or across sectors. Tiers range from partial (tier 1) to adaptive (tier 4), and describe a growing degree of maturity. Organisations should determine their target tier level, ensuring that their chosen level meets their particular organisational goals. The measures presented here to improve ICT resilience (see Section 2) remain useless if they are not implemented at company level. It is important that those in charge understand the importance of cybersecurity issues, that the awareness of staff and partners is raised, and that sufficient resources are planned and made available to implement these measures. It is recommended that an assessment of this minimum standard be conducted at least annually, and action needed to improve resilience taken as quickly as possible. Security is not a static state that can be achieved. Security is a process which must be conducted, evaluated, amended and improved continually. Cybersecurity can no longer be ignored. There is no time like the present to take appropriate action to improve the resilience of your critical ICT assets. Each of the tasks presented in Section 2 must be scored on a scale of 0 to 4 (please refer to the scoring system set out below in 3.2.1). These scores form the basis for an evaluation of an organisation’s tier level (see Section 3.3). 3.1.1 Task scoring system 0 = Not implemented 1 = Partially implemented, not fully defined and adopted 2 = Partially implemented, fully defined and adopted 3 = Implemented, fully or largely implemented, static 4 = Adaptive, implemented, continuously reviewed, improved The next section presents detailed descriptions of the four tier levels. 3.2.1 Tier 1: partial Tier level 1 reflects risk management processes and organisational cybersecurity requirements which have not been formalised. Thus, cybersecurity risks are generally managed on an ad-hoc or reactive basis. There is an integrated risk management programme at the organisational level, but no institutionalised awareness of cybersecurity risks or an organisation-wide approach to managing them. Typically, the organisation will not have procedures in place to make coordinated use of information on cybersecurity. Similarly, in many cases, where cybersecurity risks occur the organisation will not have standardised procedures by which to share information or to coordinate collaboration with external partners. 3.2.2 Tier 2: risk informed Organisations which classify themselves into tier 2 typically have risk management procedures in place to counter cybersecurity risks. However, they are not implemented in the form of specific instructions that staff must follow. At the organisational level, cybersecurity risks are integrated into the company-wide risk management system, and there is a certain awareness at all levels of the business. That said, such organisations usually lack company-wide approaches to managing and improving awareness of current and future cybersecurity risks. Approved procedures and processes are defined and implemented. Staff have sufficient resources to fulfil their roles in connection with cybersecurity. Cybersecurity information is shared within the organisation on an informal basis. The organisation understands its role in the broader environment and communicates with external partners (e.g. customers, suppliers, service providers, etc.) on cybersecurity issues. There are no standardised procedures for cooperating or for sharing information with these partners, however. Minimum ICT standard 2018 37