Security Planning Guide - Defense-in-Depth

• We kindly ask for your consent to participate in our "Security Planning Guide" survey. We assure you that your information will be kept confidential, and you won't need to share any personal details. Your valuable input will help us enhance our security planning resources. Please respond with "YES" to confirm your agreement or contact us with any questions. Thank you for your participation!

  Yes

  No

  N/A

• Name:

• Organization:

• Contact Number:

• Email:

• What is your Role?

  Administrative Staff

  Human Resource Staff

  Finance Department Staff

  Other

• Please specify:

• What security level do you want to assess?

  Physical Level

  Network Level

  Application Level

  Host Level

  Data Level

Security Guards

• Are there security guards present at the LGU premises to monitor and control access?

  Yes

  No

  N/A

• Do security guards conduct regular patrols?<br>

  Yes

  No

  N/A

• Do they monitor CCTV cameras to ensure the premises are secure?

  Yes

  No

  N/A

• Are there frequent instances of criminal activity in your area?

  Yes

  No

  N/A

CCTVs

• Do I have CCTVs in place?

  Yes

  No

  N/A

• If I have CCTVs in place, are they installed in the proper and appropriate places?

  Yes

  No

  N/A

• If I have CCTVs in place, do the CCTVS cover all the areas around the municipal building?

  Yes

  No

  N/A

• Are there any valuable assets, sensitive information, or critical infrastructure in the area that need protection?

  Yes

  No

  N/A

• Do you have specific areas in your premises that require ongoing surveillance?

  Yes

  No

  N/A

• Have there been past incidents or security breaches that could have been better addressed if security cameras were in place?

  Yes

  No

  N/A

Fence and Grills

• Do I have Fences in place?

  Yes

  No

  N/A

• If I have fences in place, do the security fences have anti-climbing features?

  Yes

  No

  N/A

• Is the area prone to unauthorized entry?

  Yes

  No

  N/A

• Have there been past incidents or security breaches that could have been better addressed if security cameras were in place?

  Yes

  No

  N/A

Lighting

• Do I have outdoor lighting in place?

  Yes

  No

  N/A

• If there is outdoor lighting in place, is there sufficient lighting in all public areas of the municipal building during nighttime?

  Yes

  No

  N/A

• If there is outdoor lighting in place, are all entrances and exits of the municipal building well-lit for security purposes?

  Yes

  No

  N/A

• Is the municipality satisfied with the overall lighting conditions around the building for security purposes?

  Yes

  No

  N/A

Visitor Management

• Is there a visitor management system in place to track and monitor visitor access to municipality premises?

  Yes

  No

  N/A

• Are visitors required to sign in and provide identification upon entry?

  Yes

  No

  N/A

• If yes, is it enforced consistently?

  Yes

  No

  N/A

• Is there a designated area or reception for visitors to check in and receive information?

  Yes

  No

  N/A

• Are there restrictions on visitor access to sensitive or restricted areas within the municipal building?

  Yes

  No

  N/A

• Is the municipality satisfied with the overall effectiveness of its visitor management system?

  Yes

  No

  N/A

Network Connection

• Does the municipality provide Wi-Fi for its employees within the municipal building?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, is the Wi-Fi connection in the municipal building secured with a password?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, is there a separate guest network for public use?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, are there limitations on the number of devices that can connect to the Wi-Fi network?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, is the Wi-Fi network regularly monitored for unauthorized access?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, are employees provided with guidelines for connecting their devices to the Wi-Fi network securely?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, is the Wi-Fi network coverage sufficient for the municipality's needs?

  Yes

  No

  N/A

• If the municipality provides Wi-Fi, is the municipality satisfied with the overall security and performance of the Wi-Fi network?

  Yes

  No

  N/A

Third-party Firewall

• Do I have a firewall in place to protect its network?

  Yes

  No

  N/A

• If yes, is the firewall regularly updated with the latest security patches?

  Yes

  No

  N/A

• Has the municipality experienced any security incidents or breaches related to their firewall?

  Yes

  No

  N/A

• Is the municipality satisfied with the level of protection provided by their firewall?

  Yes

  No

  N/A

Virtual Private Networks (VPNs)

• Is remote work or the work from home setup an option for the office?

  Yes

  No

  N/A

• If yes, are the employees in this setup using VPN?

  Yes

  No

  N/A

• Are employees provided with guidelines or instructions on how to connect to the municipality's VPN?

  Yes

  No

  N/A

• Are there restrictions on the types of activities or resources that can be accessed through the VPN?

  Yes

  No

  N/A

• Is the municipality satisfied with the overall security and effectiveness of its VPN implementation?

  Yes

  No

  N/A

• Does the LGU develop custom-made applications tailored to its specific needs?

  Yes

  No

  N/A

• Is there a process for regularly assessing and testing the security of applications to identify vulnerabilities or weaknesses?

  Yes

  No

  N/A

• Does the LGU have a website or web-based applications that interact with users or provide online services?

  Yes

  No

  N/A

• If yes, are there concerns about the security of user data collected or processed through the LGU's website or web applications?

  Yes

  No

  N/A

• Have there been reported incidents of website defacement, unauthorized access, or data breaches related to the LGU's online presence?

  Yes

  No

  N/A

• Are there concerns about the availability and performance of the LGU's website or web applications?

  Yes

  No

  N/A

• Do you utilize government-provided applications such as GIS (Geographic Information System), eBPLS (Electronic Business Permit and Licensing System), and eBIR (Electronic Bureau of Internal Revenue)?

  Yes

  No

  N/A

• Do you utilize productivity applications like Microsoft Office, Microsoft Teams, and Zoom?

  Yes

  No

  N/A

• If yes, are applications regularly patched and updated?

  Yes

  No

  N/A

Patch Management

• Do you have computer systems or networks and applications in your municipal hall?

  Yes

  No

  N/A

• Do you desire to ensure the stability and performance of your computer systems?

  Yes

  No

  N/A

Anti-Virus

• Do I have antivirus installed on my device?

  Yes

  No

  N/A

• Has the municipality experienced any security incidents or breaches related to malware?

  Yes

  No

  N/A

Business Email

• Does the municipality have a dedicated business email system for official communication?

  Yes

  No

  N/A

• If the municipality utilizes business emails, are there password requirements in place for accessing the municipality's business email accounts?

  Yes

  No

  N/A

• If the municipality utilizes business emails, are there measures in place to prevent unauthorized access to the municipality's business email accounts?

  Yes

  No

  N/A

• If the municipality utilizes business emails, is there a policy in place regarding the acceptable use of the municipality's business email system?

  Yes

  No

  N/A

• Does the municipality have backup and recovery mechanisms in case of email system failures or data loss?

  Yes

  No

  N/A

• Has the municipality experienced any security incidents or breaches related to their business email system?

  Yes

  No

  N/A

• If the municipality utilizes business emails, does the municipality regularly review and update their security measures for the business email system?

  Yes

  No

  N/A

Security Awareness & Training

• Are employees aware of the potential security risks and threats that may impact the LGU's operations and sensitive information?

  Yes

  No

  N/A

• Are there instances where employees have unintentionally compromised the security of the LGU's systems or data?

  Yes

  No

  N/A

• Have there been reported incidents of unauthorized access, data breaches, or security breaches caused by employee actions or negligence?

  Yes

  No

  N/A

• Is security education and training provided to employees of the municipality?

  Yes

  No

  N/A

• If yes, are there specific security policies and procedures communicated to all employees?

  Yes

  No

  N/A

• Are employees educated on how to identify and report potential security risks or incidents?

  Yes

  No

  N/A

• Are there guidelines in place for secure handling and protection of sensitive information?

  Yes

  No

  N/A

• Is the municipality satisfied with the level of security awareness and training among its employees?

  Yes

  No

  N/A

Password Creation & Management

• Is there a policy in place for employees to change their passwords regularly?

  Yes

  No

  N/A

• Are employees encouraged to use unique passwords for each of their accounts?

  Yes

  No

  N/A

• Do employees create and understand the importance of strong and secure passwords?

  Yes

  No

  N/A

• Are employees prohibited from sharing their passwords with others?

  Yes

  No

  N/A

• Is there a process for securely storing and managing passwords within the municipality?

  Yes

  No

  N/A

• Are employees notified in case of suspected security breaches that may require password changes?

  Yes

  No

  N/A

• Is there a password recovery process in place for employees who forget their passwords?

  Yes

  No

  N/A

• Are employees trained on recognizing and avoiding common password vulnerabilities?

  Yes

  No

  N/A

• Is the municipality satisfied with the overall adherence to password creation and management practices by its employees?

  Yes

  No

  N/A

Cloud Data Storage

• Do I use cloud storage to store my data?

  Yes

  No

  N/A

• Is the municipality's data backed up regularly in the cloud storage?

  Yes

  No

  N/A

• If yes, does the municipality have control over who can access and manage the data stored in the cloud?

  Yes

  No

  N/A

• Has the municipality experienced any security incidents or breaches related to their cloud data storage?

  Yes

  No

  N/A

Data Backup & Disaster Recovery

• Do I have a data backup system/process in place?

  Yes

  No

  N/A

• If there is a backup process in place, is the data backup performed regularly?

  Yes

  No

  N/A

• If there is a backup process in place, has the municipality experienced any data loss incidents where the backup was utilized?

  Yes

  No

  N/A

• If there is a backup process in place, is the municipality satisfied with the level of protection provided by their data backup system?

  Yes

  No

  N/A

• Do I have a personnel who has the capacity and knowledge in implementing security measures?

  Yes

  No

  N/A

• If none, do I need personnel for monitoring, handling, and supervising the implementation of the security measures?

  Yes

  No

  N/A

• Do I have tools, equipment, and devices for the implementation of the security controls?

  Yes

  No

  N/A

• If none, do I need to have these tools and devices like laptops, maintenance tools, etc?

  Yes

  No

  N/A

• Do I have a room for IT-related personnel and security controls?

  Yes

  No

  N/A

• If none, do I need a designated room for the personnel and the devices used for security controls?

  Yes

  No

  N/A

• I am willing to have security measures and controls implemented in the community/organization?

  Yes

  No

  N/A