사이버보안 GRC 15개 항목
Phishing & Social Engineering Resilience Assessment
이 체크리스트는 영어로 제공됩니다.
Evaluates technical email defenses and human resilience against phishing, business email compromise, and social engineering attacks.
CIS v8NIST 800-53NIST 800-50
무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.
Email Authentication & Filtering
- Are SPF, DKIM, and DMARC configured for all sending domains? *
- Is the DMARC policy set to quarantine or reject? *
- Is an email security gateway filtering spam, malware, and malicious URLs? *
- Are inbound attachments sandboxed or detonated before delivery?
- Are external email banners applied to messages from outside the organization? *
Simulation & Testing
- Are phishing simulation campaigns conducted at least quarterly? *
- Is the click-through rate tracked and trended over time? *
- What was the click rate on the most recent phishing simulation?
- Are targeted or spear-phishing scenarios included for high-risk roles?
Reporting & Response
- Is there a one-click report-phishing button in the email client? *
- Are reported phishing messages triaged and remediated across all mailboxes? *
- Is the median time to remediate a reported phishing email measured?
Business Email Compromise Controls
- Is out-of-band verification required for payment or banking change requests? *
- Are wire transfer and vendor-change approvals dual-controlled? *
- Are executives and finance staff given targeted BEC awareness training? *
Phishing & Social Engineering Resilience Assessment 체크리스트 전체 다운로드
인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.