Efficient GRC Solutions and PCI Automation for Seamless Compliance

Assessment Scoping Questionnaire

Introduction

This scoping questionnaire is designed to gather information necessary to assess compliance with the National Electronic Security Authority (NESA) standards. The responses provided will help define the scope of the assessment and identify key areas that need to be reviewed. Please answer all questions as accurately and completely as possible.

General Information*

Organisation Name:*
Primary Contact Person:*
Email Address:*
Phone Number:*
Assessment Date:*
Business Sector:*
No. of Employees:*

Please provide a brief description of the organization’s mission and critical services:
Identify the systems that will be in scope for the assessment:
What types of sensitive data are processed or stored by these systems? (e.g., PII, financial data, intellectual property):
Are there any third-party systems or services integrated with the in-scope systems? If yes, please describe:	Yes	No

What is the estimated number of users accessing these systems?
What are the primary business functions of the in-scope systems?

Please provide a high-level overview of the network architecture, including key components (e.g., firewalls, routers, switches):
How is the network segmented to protect sensitive systems and data?
Are there any wireless networks connected to the in-scope environment? If so, please describe:	YesNo

Is remote access allowed to any in-scope systems? If yes, please describe the controls in place:	YesNo

What encryption methods are used for data in transit across the network?

What data classification scheme is used by the organization?
How is sensitive data identified and classified?
What are the primary data protection measures in place (e.g., encryption, access control, DLP)?
Are there any data retention and destruction policies? If so, please describe:	YesNo

Is the organization subject to any specific regulatory requirements (e.g., GDPR, HIPAA)? If yes, please list them:	YesNo

Has the organization conducted previous security assessments or audits? If yes, please provide details:
Are there any current or past non-compliance issues? If so, please describe:	YesNo

Cybersigma Consulting Services

National Electronic Security Authority(NESA) Form

Assessment Scoping Questionnaire

Introduction

General Information*

System Overview

Network Architecture

Data Classification and Protection

Compliance Requirements

Additional Information

Are there any upcoming changes to the IT environment that could impact the assessment?	YesNo

Are there any specific areas of concern that should be addressed during the assessment?	YesNo

Please provide any additional information that may be relevant to the assessment: