CISO Survey 2014 Questionnaire - Revision history

Lee Aber at 13:54, 23 July 2014

2014-07-23T13:54:07Z

Lee Aber at 18:47, 22 July 2014

2014-07-22T18:47:45Z

Tgondrom: fix CMO entry

2014-07-22T00:47:25Z

fix CMO entry

Tgondrom: final release version, please be careful with edits

2014-07-20T17:35:20Z

final release version, please be careful with edits

Tgondrom: update page 14 - finish

2014-07-20T17:33:57Z

update page 14 - finish

Tgondrom: update page 13

2014-07-20T17:32:31Z

update page 13

Show changes

Tgondrom: update page 11 and 12

2014-07-20T17:26:24Z

update page 11 and 12

Tgondrom: update page 10

2014-07-20T17:12:47Z

update page 10

Tgondrom: update page 9

2014-07-20T17:06:07Z

update page 9

Tgondrom: update page 8

2014-07-20T17:00:53Z

update page 8

@@ Line 389: / Line 389: @@
 * Chief Compliance Officer
 * GC (General Counsel)
 * Country Company CEO / Regional Company CEO
 * Business Unit Executive/Vice President

@@ Line 388: / Line 388: @@
 * Chief Privacy Officer
 * Chief Compliance Officer
 * Country Company CEO / Regional Company CEO
 * Business Unit Executive/Vice President

@@ Line 378: / Line 378: @@
 * CEO (Chief Executive Officer)
 * CIO (Chief Information Officer)
-* COO (Chief Operating Officer
+* COO (Chief Operating Officer)
-* CMO
+* CMO (Chief Marketing Officer)
 * CTO (Chief Technology Officer)
 * CFO (Chief Financial Officer)

← Older revision		Revision as of 17:35, 20 July 2014
Line 1:		Line 1:
	= CISO Survey 2014 - final version =		= CISO Survey 2014 - final version =

−	Here to the live Survey: [https://www.surveymonkey.com/s/CISOSurvey2014]	+	Here to the live Survey: [https://www.surveymonkey.com/s/CISOSurvey2014 https://www.surveymonkey.com/s/CISOSurvey2014]

@@ Line 559: / Line 559: @@
-== Page 21. Thank You ==
+== Page 14. Thank You ==
-−
-Thank you again for your time and considering in completing this survey. Please contact Tobias Gondrom at tobias.gondrom@owasp.org with any questions or comments regarding the contents of this survey.
+Thank you very much for your time and consideration in completing this survey.

@@ Line 440: / Line 440: @@
-== Page 14. Governance and Control (continued) ==
+== Page 11. Wishes and Suggestions ==
-*A.BSIMM
+. And last, but not least, all your feedback is very important to us and the community is continuously striving to improve. If you could wish freely, what kind of OWASP project, guidance or tool would you like to see in the future that could really improve your daily life and operation around web and application security?
-*B.Capability Maturity Model Integration (CMMI)
+(text)
-*C.CLASP
+This completes the main part of the survey.
-*A.Internal self assessments by IT or application security function
+== Page 12. OPTIONAL: Participant Information (treated as strictly confidential) ==
-. Suppliers & External Partners: How do you verify that your external partners, service providers or contractors are protecting your organization's information from an application security standpoint? (choose all that apply):
+. Participate in lucky draws: To thank you for your time answering this survey, there will be lucky draws among all people who answered. You can win valuable conference tickets, CISO training tickets and other prizes. Do you wish to participate in these lucky draws? (in which case we would need you to enter your email address below, so we can notify you if you win)
-* We communicate our security requirements to our key suppliers and partners?
+. CISO updates: We can send you a copy (of course for free) when this survey report will be released. Do you wish to receive CISO updates from OWASP via email?
-*A.Assessments performed by your organization's application security, procurement or internal audit function (e.g., site visits, security testing)
+( Yes, No)
-c. How confident do you feel about the effectiveness of processes and resources to recover from a significant cyber security incident?
+. Participant Information (optional; email address is needed if you like to participate in the lucky draws to win one of the prizes):
-rate 1-5 (very low - very high)
+* Name:
-d. Process of Incident Response:
+. What specific additional areas would you like us to cover in future versions of the OWASP CISO Survey and OWASP CISO Guide?
-* Contact law enforcement
+(text)
-. How you describe your job role/function?
+. To further refine our survey data by a qualitative component, we would also like to ask whether you would potentially be open for a 30-minute confidential phone interiew with one of our researchers to further refine certain areas and learn more about your views for future surveys and application security projects that matter to you. All data will be treated as confidential and only be used in anonymous and aggregated forms.
 == Page 16. Governance and Control (Scope of the CISO role) ==

@@ Line 345: / Line 345: @@
-. Which of the following statements best describes your organization's application security strategy in regards to the risks associated with the increased use of social networking, personal devices, or cloud computing? (choose one)
+. Who are you reporting to?
-. Has your organization implemented an Application Security Management System (ASMS) or Maturity Model (e.g., OWASP SAMM) that covers overall management of application security? (choose one)
+. Size of Security Team: How many FTEs (full-time employees, incl. contractors) does your organization employ within the information security function? (number)
 == Page 14. Governance and Control (continued) ==

@@ Line 287: / Line 287: @@
-== Page 12. Governance and Control ==
+== Page 9. Governance and Control (continued) ==
-. Does your organization have a documented application security strategy?
+. Has your organization implemented an Application Security Management System (ASMS) or Maturity odel (e.g. OWASP SAMM) that covers overall management of application security? (Choose one)
-*A.Yes
+. Which of the following list of application security standards or frameworks, are used by your organization? (Choose all that apply)
-*B.No
+* BSIMM
-. For how long does this application security strategy plan ahead?
+. How does your organization assess the quality and effectiveness of application security? (Choose all that apply)
-*A 3 months
+* Internal self assessments by IT or application security function
-*B 6 months
+* Assessments performed by other internal function
-*C 1 year,
+* Assessment by external party/third party
-*D 2 years,
+* Formal certification to external security standards
-*E 3 years,
+* Formal certification to industry security standards (e.g. Payment Card Industry Data F, Security Standard)
-*F 5 years+ (circle one)
+* Code review and metrics
-*A....has been reviewed and updated within the past 12 months
+. Suppliers & External Partners: How do you verify that your external partners, service providers or contractors are protecting your organization's information from an application security standpoint? (Choose all that apply)
-*B...is aligned with, or integrated into, the organization's business strategy
+* We communicate our security requirements to our key suppliers and partners
-*C...is aligned with, or integrated into, the organization's IT strategy
+* Asessments performed by our organization's application security, procurement or internal audit function (e.g. site visits, security testing)
-*D...outlines our key security activities for the next 12 months
+* Independent external assessments of partners, vendors or contractors

@@ Line 253: / Line 253: @@
-== Page 11. Tools and Technology (continued) ==
+== Page 8. Governance and Control ==
-. As part of your information security management program, do you...
+. How confident are you that your organization is protected from cyber security risk?
-Currently in use,Planned within 12-18 months,No plans to implement
+( we are very secure, we are good, we are ok, we have problems, we are not secure, Don't know.)