Technology errors and omissions

Cyber Control Readiness 40 of 40 checks apply here

• No published control baseline is recorded, so there is nothing to map your answers onto.

  Two current public baselines cover everything this module asks about: NIST Cybersecurity Framework (CSF) 2.0, published 2024-02-26, which organizes outcomes under GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER, and CISA Cross-Sector Cybersecurity Performance Goals Version 2.0, dated December 2025, which is aligned to those same CSF 2.0 functions and which the CISA program page describes as voluntary goals that strive to help small- and medium-sized organizations kickstart their cybersecurity efforts by prioritizing investment in a limited number of essential actions. Mapping to a named, dated edition means an answer you give today can be checked against a fixed public text later.

  question nist-csf-2-0 cisa-cpg-2-0 cisa-cpg-program-page

• Multi-factor authentication is recorded as not in place on any account.

  CISA CPG 3.F states that organizations require MFA to access assets using the strongest available method, and that all IT accounts leverage MFA with priority given to privileged administrative accounts. NIST CSF 2.0 carries the same outcome as PR.AA-03, users, services, and hardware are authenticated.

  gap cisa-cpg-2-0 nist-csf-2-0

• Multi-factor authentication is recorded as partial, and no answer here says which accounts are outside it.

  A partial answer will be read differently by every reader unless the uncovered set is named. CPG 3.F asks that all IT accounts use MFA and that privileged administrative accounts for key systems be prioritized, so the question that matters is whether the uncovered accounts are administrative or remotely reachable, not how many there are.

  question cisa-cpg-2-0

• Multi-factor authentication is in place but no dated written evidence of it is held.

  This is a different open item from not having the control. Cyber underwriting has moved toward asking for control evidence rather than accepting a yes on its own, and CSF 2.0 GV.PO-01 treats policy as something established, communicated, and enforced, which implies it exists in writing. An enforced control with no artifact is hard to confirm and hard to re-confirm at the next renewal.

  documentation chubb-cyber-cope-whitepaper nist-csf-2-0

• No offline or immutable backup copy is recorded.

  CISA CPG 3.O directs organizations to securely store backups offsite and offline, and notes that adversaries delete data and disable recovery services to prevent system recovery. CSF 2.0 PR.DS-11 states that backups of data are created, protected, maintained, and tested. A backup that your own administrator credentials can reach is reachable by anyone who takes those credentials.

  gap cisa-cpg-2-0 nist-csf-2-0

• Offline or immutable backups are in place but no written backup inventory and retention schedule is held.

  CPG 3.O asks organizations to develop a list of all maintained backups, including installation media, license keys, configuration information, and the retention period for the information. Without that list, nobody can say during an incident what exists, how far back it goes, or what is needed to stand a system up again.

  documentation cisa-cpg-2-0

• No restore has ever been tested.

  CPG 3.O directs that backups and recovery be tested on a recurring basis, no less than once per year, and that the integrity of backups be validated before restoration is started. CSF 2.0 adds RC.RP-03, the integrity of backups and other restoration assets is verified before using them for restoration.

  gap cisa-cpg-2-0 nist-csf-2-0

• Backups are recorded as in place while the restore test is recorded as never performed.

  These two answers describe two different things, and taken together they say the recovery path is unproven. CSF 2.0 PR.DS-11 makes testing part of the outcome itself, backups of data are created, protected, maintained, and tested, and CPG 3.O pairs storing backups offline with testing backups and recovery at least annually.

  inconsistency nist-csf-2-0 cisa-cpg-2-0

• Restores are tested but no dated written result for the most recent test is held.

  CPG 3.O expects testing on a recurring basis with integrity validated before restoration, and CSF 2.0 ID.IM-02 treats improvements identified from tests and exercises as an outcome in its own right. A test that produced no record cannot show a date, a scope, or what was fixed afterwards.

  documentation cisa-cpg-2-0 nist-csf-2-0

• The last recorded restore test is more than twelve months old.

  CPG 3.O sets the cadence explicitly: test backups and recovery on a recurring basis, no less than once per year. The date you entered is more than twelve months old, so the stated annual cadence has lapsed.

  timing cisa-cpg-2-0

• No endpoint detection is recorded on laptops, desktops, or servers.

  CPG 4.A directs organizations to implement both signature-based mechanisms and non-signature-based mechanisms focused on behavior, heuristics, or anomalies to detect and eradicate malicious code at system endpoints, organization-wide. CSF 2.0 DE.CM-01 covers the monitoring side, networks and network services are monitored to find potentially adverse events.

  gap cisa-cpg-2-0 nist-csf-2-0

• Endpoint detection is in place but no dated coverage report is held.

  Coverage is the part of this control that drifts, because new devices arrive and old ones leave. CPG 4.A scopes malicious code detection organization-wide and asks that the software be updated, active, and configured to scan automatically, which is a claim about every device rather than about the tool. A dated coverage report is the artifact that supports the claim.

  documentation cisa-cpg-2-0 chubb-cyber-cope-whitepaper

• No defined patch cadence is recorded.

  CPG 2.B directs organizations to implement a vulnerability management program to patch and mitigate misconfigured software in a timely manner across all organizational assets, including those that face the internet, and notes that adversaries frequently target unpatched and misconfigured systems. CSF 2.0 PR.PS-02 states that software is maintained, replaced, and removed commensurate with risk.

  gap cisa-cpg-2-0 nist-csf-2-0

• Patch cadence is recorded as partial, which leaves open which assets are outside the schedule and why.

  CPG 2.B scopes patching to all organizational assets, to include those that face the internet, and in its operational technology note asks that where patching is not possible compensating controls such as segmentation or monitoring be applied and recorded. A partial answer becomes answerable once the exceptions are named and the reason for each is written down.

  question cisa-cpg-2-0

• A patch cadence is followed but there is no written patching standard and no record of what was patched when.

  CPG 2.B asks for a vulnerability management program and for progress to be monitored through artifacts such as a plan of action and milestones, a risk register, or risk detail reports, with responsibilities assigned and procedures followed. Those are all written things, so a cadence that leaves no record cannot demonstrate timeliness after the fact. CSF 2.0 PR.PS-02 is the underlying outcome.

  documentation cisa-cpg-2-0 nist-csf-2-0

• The number of individuals whose personal information you hold is recorded as unknown.

  CPG 2.A asks organizations to maintain a regularly updated inventory of all organizational assets, expressly including data, and CPG 3.K asks you to identify critical electronic file types and data to protect while in transit and at rest, which may include personally identifiable information. CSF 2.0 places asset management in the IDENTIFY function. An unknown here also means notification exposure cannot be scoped later, since deadlines run from discovery rather than from when you finish counting.

  question cisa-cpg-2-0 nist-csf-2-0 cfr-45-164-404-lii

• Payment card transactions are accepted and awareness training is not recorded as in place for all users.

  CPG 3.J names the specialized roles that warrant additional, role-based cybersecurity training, and finance personnel, senior leadership, and anyone with access to business-critical data are on that list alongside system administrators. Where money moves, the roles that move it are the ones the training is aimed at, and CPG 3.K asks separately that critical electronic file types and data be identified and protected while in transit and at rest.

  question cisa-cpg-2-0

• Neither email filtering nor sender authentication is recorded as configured.

  CPG 3.L states that on all corporate email infrastructure STARTTLS is enabled, SPF and DKIM are enabled, and DMARC is enabled and set to reject, in order to reduce risk from spoofing, phishing, and interception. CSF 2.0 PR.DS-01 and PR.DS-02 cover protecting data at rest and in transit.

  gap cisa-cpg-2-0 nist-csf-2-0

• Email filtering and sender authentication are in place but no dated record of the published configuration is held.

  CPG 3.L is unusual among these controls because it is externally checkable, and it names a specific end state including DMARC set to reject. Recording what is published, and on what date, keeps a later answer honest if someone changes the policy value in the meantime.

  documentation cisa-cpg-2-0

• Administrator rights are never re-reviewed.

  CPG 3.G states that user accounts do not have administrator privileges, that administrators maintain separate user accounts for activities unrelated to their admin role such as business email and web browsing, and that privileges are re-evaluated on a recurring basis to validate continued need for a given set of permissions. CPG 3.H, a separate goal, asks that all user accounts, system roles, and processes operate with the minimum privileges necessary and that quarterly reviews of access permissions and role assignments be performed. CPG 3.D adds that user access should be reviewed and accounts disabled when inactive for a specified period, for example thirty days. CSF 2.0 PR.AA-05 requires access permissions to be defined in policy, managed, enforced, and reviewed with least privilege in mind.

  gap cisa-cpg-2-0 nist-csf-2-0

• Privileged access is reviewed but no dated review record or written offboarding checklist is held.

  CPG 3.D asks for a defined and enforced administrative process to offboard staff, contractors, and vendors, including return of tokens or badges and revocation of all access. A review that leaves no record cannot show when it last happened or what changed, which is exactly what a later reviewer asks.

  documentation cisa-cpg-2-0 chubb-cyber-cope-whitepaper

• No incident response plan is recorded.

  CPG 1.C directs organizations to develop, maintain, update, and regularly exercise incident response plans for common and organization-specific threat scenarios. CPG 4.B assumes the plan already exists, because it says that if an adverse event is suspected you follow the protocol outlined in the incident response plan to escalate. CSF 2.0 RS.MA-01 states that the incident response plan is executed in coordination with relevant third parties once an incident is declared.

  gap cisa-cpg-2-0 nist-csf-2-0

• An incident response plan exists in practice but is not written down.

  This is the sharpest case of the difference between having a control and being able to evidence it. CPG 1.C asks that IR plans be developed, maintained, updated, and drilled, which are all acts performed on a document, and CSF 2.0 RS.MA-01 speaks of the plan being executed in coordination with third parties, which assumes third parties can be handed something. An unwritten plan also cannot be found during the outage that triggers it.

  documentation cisa-cpg-2-0 nist-csf-2-0

• The incident response plan was last exercised more than twelve months ago.

  CPG 1.C sets the cadence explicitly: IR plans should be reviewed and drilled, at a minimum, on an annual basis, and asks that drills be realistic and include all relevant stakeholders. The date you entered is more than twelve months old, so that stated cadence has lapsed. CSF 2.0 ID.IM-02 is the outcome the drill is for, improvements identified from security tests and exercises.

  timing cisa-cpg-2-0 nist-csf-2-0

• No security awareness training is recorded for people with accounts.

  CPG 3.J directs that new employees receive initial cybersecurity training prior to accessing computer systems and that at least annual training be provided for all organizational users, covering recognizing social engineering attempts, reporting suspicious activity, and basic cyber hygiene. Its scope reaches employees, contractors, partners, suppliers, and other users of non-public resources. CSF 2.0 PR.AT-01 is the matching outcome.

  gap cisa-cpg-2-0 nist-csf-2-0

• Security awareness training happens but no dated completion record is held.

  CPG 3.J is a coverage claim about all organizational users, not about whether a course exists, so the only thing that supports it is a record of who completed it and when. Underwriting review of cyber controls has moved toward asking for that kind of artifact rather than a yes.

  documentation cisa-cpg-2-0 chubb-cyber-cope-whitepaper

• The most recent training round closed more than twelve months ago.

  CPG 3.J sets at least annual cybersecurity training for all organizational users. The date you entered is more than twelve months old, so the annual cadence has lapsed even though a programme exists.

  timing cisa-cpg-2-0

• The written evidence for these controls has not been assembled in one place.

  Every control in this module resolves to an artifact somebody can read: a policy, a configuration export, a coverage report, a dated test result, a completion record, a backup inventory. Cyber underwriting increasingly turns on that evidence rather than on the answer alone, and assembling it once means the same pack serves renewal, a contract request, and an internal review.

  documentation cisa-cpg-2-0 chubb-cyber-cope-whitepaper

• A submission date is recorded while the control evidence is recorded as not assembled.

  You have set yourself a date and have not yet gathered the artifacts the control answers rest on. The artifacts CPG 2.0 implies for these goals, including the backup inventory under 3.O, the drilled IR plan under 1.C, and the training records under 3.J, all take days to produce rather than minutes.

  documentation cisa-cpg-2-0

• Nobody has been identified who can confirm the control answers in writing.

  Applications are signed, and the control answers above are the part someone will be held to. CPG 1.A places cybersecurity roles, responsibilities, and authorities in writing as a governance outcome, asking that all roles and responsibilities involving cybersecurity be documented in an organization's cybersecurity policy, and CSF 2.0 GV.PO-01 treats policy as established, communicated, and enforced rather than assumed.

  question cisa-cpg-2-0 nist-csf-2-0

• An outside provider runs IT and the security and notification terms of that agreement have not been read.

  CPG 2.0 added net-new goals addressing managed service providers, least privilege, and incident communication procedures, and CPG 1.D covers notifying a customer of security incidents and vulnerabilities within a risk-informed time frame. Several answers above describe work the provider performs, so the agreement decides who must tell you, how fast, and what evidence you can obtain.

  question cisa-cpg-program-page cisa-cpg-2-0

• A hosted system holds customer or client records and its security and notification terms have not been read.

  CPG 1.D concerns notifying a customer of security incidents and vulnerabilities within a risk-informed time frame, which is the same obligation running toward you from whoever holds your data. If a notification clock starts on discovery, the practical question is when the holder of the data tells you, because that is when your own clock can start.

  question cisa-cpg-2-0 cfr-45-164-404-lii

• A contract requires cyber or privacy liability coverage and no cyber coverage is recorded.

  You have recorded a contractual requirement to carry this coverage and recorded none in force, which is a mismatch between an obligation you have accepted and what your programme shows. CSF 2.0 places supply chain and third-party commitments inside the GOVERN function as category GV.SC, Cybersecurity Supply Chain Risk Management, so this belongs with your governance records rather than being treated as a purchasing detail; the controls recorded above are a separate matter from the coverage question and neither substitutes for the other.

  gap nist-csf-2-0 Related question

• The recorded cyber limit is lower than the limit the strictest contract requires.

  This is arithmetic on the two numbers you entered: the limit recorded on your coverage is less than the limit the contract demands. A shortfall against a contractual figure is a contract compliance question first, and it sits inside the same third-party governance work that CSF 2.0 collects under GV.SC, Cybersecurity Supply Chain Risk Management; matching numbers still does not mean two policies respond to the same thing.

  inconsistency nist-csf-2-0 Related question

• A contract requires cyber coverage and the limit it demands is not recorded.

  You recorded a contractual requirement to carry this coverage without recording the limit the clause names. Until that figure is written down there is nothing to compare a policy against, so the requirement cannot be checked at all. CSF 2.0 places third-party commitments inside the GOVERN function as category GV.SC, Cybersecurity Supply Chain Risk Management, which is where an obligation of this kind belongs on the record.

  documentation nist-csf-2-0 Related question

• The limit a contract requires is recorded, and the limit actually carried is not.

  You recorded what the clause demands but not what your own coverage carries, so the comparison this module would otherwise run cannot be run. The figure is on your declarations page rather than a matter of recollection. CSF 2.0 collects third-party commitments under GV.SC, Cybersecurity Supply Chain Risk Management.

  documentation nist-csf-2-0 Related question

• Protected health information is handled, an incident is recorded as discovered more than sixty calendar days ago, and notification is recorded as not sent.

  45 CFR 164.404(b) provides that a covered entity shall provide the required notification without unreasonable delay and in no case later than sixty calendar days after discovery of a breach. The discovery date you entered is more than sixty calendar days ago, so on the dates recorded that outer limit has already passed. Whether the event is a breach requiring notification at all is a legal determination, not something this module can decide.

  timing cfr-45-164-404-lii

• Protected health information is handled, an incident was discovered within the last sixty calendar days, and notification is recorded as not sent.

  45 CFR 164.404(b) requires notification without unreasonable delay and in no case later than sixty calendar days after discovery. The discovery date you entered is within the last sixty calendar days, so the outer limit has not yet passed; note that the without unreasonable delay wording means the sixty days is a ceiling and not a permitted waiting period.

  timing cfr-45-164-404-lii

• The sector recorded is healthcare, and CISA publishes Healthcare Sector-Specific Goals beyond the cross-sector set.

  CISA lists Sector-Specific Goals as available now for the Healthcare sector, described as voluntary practices that go beyond the Cross-Sector CPGs. Those goals are a published text you can map to by name, in the same way as the cross-sector goals in CPG 2.0, Version 2.0, December 2025.

  question cisa-cpg-program-page cisa-cpg-2-0

• A prior cyber incident is recorded while no written incident response plan is recorded.

  The business has already been through the event the plan exists for, and the plan is still recorded as absent. CPG 1.C treats plan development, maintenance, and drilling as the mechanism for identifying improvements, and CSF 2.0 ID.IM-02 makes improvements identified from tests and exercises an explicit outcome.

  inconsistency cisa-cpg-2-0 nist-csf-2-0