← VCE Data Analytics U4O1

Using a checklist to confirm security controls are implemented

A list with one security control per line, a yes/no check and evidence, plus who checked and when, used to confirm each control was set up correctly and to fix any failed items.

Part of: VCE Data Analytics - U4O1 - Development and Evaluation — Module 49

Understanding Using a checklist to confirm security controls are implemented in VCE Data Analytics U4O1

What it does: The evidence column names something checkable, such as a log file, so the Yes can be trusted. A No result must lead to a fix and a recheck, with the new result recorded on the checklist. One control per line lets you confirm each control separately, so a failed control is easy to spot and fix. Recording who checked and when makes the checklist accountable and shows how current the check is. Failed items must be fixed and rechecked. Deleting them hides the problem and the data stays at risk. A checklist question needs a clear yes/no answer about one specific control.

Common mistakes: Each check on an implementation checklist must be a clear yes/no answer. 'Maybe' does not confirm anything. It should read 'Check: Is MFA on? Yes/No'. A checklist has one control per line. Backup and encryption are two controls, so each needs its own line. The line should be 'Control: Daily backup'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Using a checklist to confirm security controls are implemented to a class →

This module's key terms are also in a printable crossword (Modules 38–62) and word search (Modules 3–62).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
How should an implementation checklist list security controls?
One control per line, each with its own yes/no checkAll controls combined into one line with a single tick
Matches
Passwords, MFA and backups | Yes
↓
Three controls are combined on one line, and there is no evidence, checker or date
Applying
Meanings
Term
implementation checklist
Meaning
A list with one security control per line, a yes/no check and evidence, plus who checked and when, used to confirm each control was set up correctly and to fix any failed items.
Practice
Control | Done | Evidence | Who | When
Testing
Gaps
=(C2:C9,"No")
Check Answer
Spots
1Control: Turn on MFA
2Check: Is MFA on? Maybe

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Manta Ray' badge — Graceful Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. How should an implementation checklist list security controls?
A. All controls combined into one line with a single tick
B. One control per line, each with its own yes/no check ✓
One control per line lets you confirm each control separately, so a failed control is easy to spot and fix.
2. Which entry is good evidence that multi-factor authentication is working?
A. Screenshot of the login asking for a code after the password ✓
B. A note saying 'I think it is fine'
Evidence must be something you can show or check, such as a screenshot or test result, not an opinion.
3. What should a checklist record besides the yes/no result and evidence?
A. Who checked the control and the date it was checked ✓
B. The favourite colour of the person who checked
Recording who checked and when makes the checklist accountable and shows how current the check is.
4. A control is marked 'No' on the checklist. What should happen next?
A. Fix the control, then check it again and record the new result ✓
B. Delete the row so the checklist looks complete
Failed items must be fixed and rechecked. Deleting them hides the problem and the data stays at risk.
5. Which Yes/No check is written well enough for a checklist?
A. Is security good? Maybe
B. Is the backup file stored in the encrypted folder? Yes/No ✓
A checklist question needs a clear yes/no answer about one specific control.

Match the Pairs

Control | Check | Evidence | Checked by | Date → The column headings of an implementation checklist, which record each control, its yes/no result, proof, who checked it and when
MFA on staff accounts | Yes | Screenshot of settings | J. Lee | 12/09 → One completed checklist line: one control, a passed check, evidence, the checker and the date
Each checklist line should record the evidence that proves the control is in place → Backup runs nightly | Yes | Log file 12-09.txt
A failed item is fixed, then rechecked and recorded again → Encryption on laptops | No | Fix: turn on encryption, recheck 14/09
Passwords, MFA and backups | Yes → Three controls are combined on one line, and there is no evidence, checker or date
Firewall enabled | No | (left as it is) → A failed check was recorded but never fixed or rechecked

Key Term

implementation checklist
A list with one security control per line, a yes/no check and evidence, plus who checked and when, used to confirm each control was set up correctly and to fix any failed items.

Fill in the Blanks

1. =COUNTIF(C2:C9,"No")
Hint: Type the function that counts cells matching a condition, to total the failed checks.
2. =IF(C2="Yes","Pass","Fix")
Hint: Type the function that chooses between two results depending on a yes/no check.
3. =COUNTIF(C2:C9,"Yes")/COUNTA(A2:A9)
Hint: Type the operator that divides passed controls by total controls to give the proportion complete.
4. =IF(C2="Yes",TODAY(),"")
Hint: Type the function that returns the current date, to record when the check was passed.
5. =IF(COUNTIF(C2:C9,"No")=0,"All done","Fix")
Hint: Type the comparison operator that tests whether the number of failed items equals zero.

Spot the Error

Question 1
A Control: Turn on MFA
B Check: Is MFA on? Maybe
C Evidence: Screenshot of login
D Checked by: Sam, 12 Mar
Line B — Each check on an implementation checklist must be a clear yes/no answer. 'Maybe' does not confirm anything. It should read 'Check: Is MFA on? Yes/No'.
Question 2
A Control: Backup, encrypt
B Check: Backup ran? Yes
C Evidence: Log shows 2am run
Line A — A checklist has one control per line. Backup and encryption are two controls, so each needs its own line. The line should be 'Control: Daily backup'.
Question 3
A Control: Encrypt laptops
B Evidence: I think it is on
C Check: Yes
D Checked by: Mia, 3 Apr
Line B — Evidence must be proof that others can look at, such as a screenshot. An opinion is not evidence. It should be 'Evidence: Settings screenshot'.
Question 4
A Control: Install antivirus
B Check: Is it installed? Yes
C Evidence: Scan report saved
D Checked by: Leo
Line D — The checklist must record who checked and when. The date is missing. It should be 'Checked by: Leo, 5 May'.
Question 5
A Control: Improve security
B Check: Is minimum 12? Yes/No
C Evidence: Policy settings page
Line A — Each control must be specific so it can be checked with a yes/no answer. 'Improve security' is too vague. It should name the control, such as 'Control: Min password 12 chars'.

Student with a class code? Join your class →