McCans Cyber Security Self Assessment

• Site conducted

• Conducted on

  Date

• Prepared by

• Location
  Address

• I understand to ~ Please INCLUDE Pictures (when applicable)

  Sign

Sonic Cybersecurity Store Self-Assessment ~ As you know, cybercriminals pose a constant threat to our business, and a breach could cost us significant time, money, and damage to our reputation. While our IT and Cybersecurity teams work diligently to secure our systems, it takes everyone working together to keep our data and systems safe from cybercriminals.

Physical Security the Visitor’s Log

• □ Make sure doors are closed and locked

  Yes

  No

  N/A

• □ Always check and verify the ID of non-employees who want to come inside, and fill out. Include Picture

  Media

• □ Your server cabinet should be locked, and the keys should be stored in the safe

  Yes

  No

  N/A

• □ Each employee should have his/her own ID or MagCard to ring up transactions or clock in

  Yes

  No

  N/A

• □ Passwords should not be written down or shared

  Yes

  No

  N/A

• □ Sensitive information, such as employee data (e.g., Social Security Number, Date of Birth, etc) or sales data (e.g., credit card information), must be locked in safe box or file cabinet

  Yes

  No

  N/A

• □ When sensitive information is no longer needed, it must be securely shredded

  Yes

  No

  N/A

• □ Always securely erase or destroy outdated or defective hard drives

  Yes

  No

  N/A

• □ Post Cybersecurity stickers and Anti-Vishing magnets so they are easily visible

  Yes

  No

  N/A

• □ Use a DVR system and/or security cameras to watch critical areas of the drive-in, including building access, POS systems, and the stalls

  Yes

  No

  N/A

• □ Check credit card machines daily for signs of skimmers. Check all machines, including those inside, outside, and in stalls. Keep a log of all your checks. If you do not know about those inside, outside, and in stalls. Keep a log of all your checks. If you do not know about skimmers, refer to the E-Learning guide

  Yes

  No

  N/A

System Access

• □ Only Sonic support team members or contracted vendors should remotely connect to store systems. These include HQ, SEI, Micros, and Infor support personnel

  Sign

Training

• □ All team members need to complete the Cybersecurity module in the TOT ZONE

  Yes

  No

  N/A

• □ Make sure new hires are aware of Cybersecurity policies, including using strong, unique passwords; not sharing passwords; handling payment cards correctly; and checking for skimmers daily

  Yes

  No

  N/A

• □ Drive-ins should provide additional security awareness training regularly once the new hire training is complete

  Yes

  No

  N/A

• Cybersecurity is everyone’s responsibility

  Yes

  No

  N/A

ARE YOU READY?

• You understand that ~ Some drive-ins will also be selected for an on-site assessment conducted by EY between September 26 and November 7. The assessment should take 15-30 minutes and will be timed to minimize disruption to the business as much as possible. These drive-ins will be contacted by email, and the assessor will attempt to call the drive-in before arrival. We will also post information about the assessors on PartnerNet so you can be confident of the assessors’ identities.

  Sign

• You are aware that ~ All drive-ins will receive an email from EY/Qualtrics during the week of September 19-22 with a link to complete an 18-question online self-assessment. We anticipate this will take no more than 20 minutes to complete. If a drive-in fails this assessment, simply review and address the failed items, then email Cybersecurity to reset and resend the assessment link. With this, we look forward to a 100% passage rate.

  Sign