Using a checklist to confirm security controls are implemented

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. How should an implementation checklist list security controls?

A All controls combined into one line with a single tick

B One control per line, each with its own yes/no check

2. Which entry is good evidence that multi-factor authentication is working?

A Screenshot of the login asking for a code after the password

B A note saying 'I think it is fine'

3. What should a checklist record besides the yes/no result and evidence?

A Who checked the control and the date it was checked

B The favourite colour of the person who checked

4. A control is marked 'No' on the checklist. What should happen next?

A Fix the control, then check it again and record the new result

B Delete the row so the checklist looks complete

5. Which Yes/No check is written well enough for a checklist?

A Is security good? Maybe

B Is the backup file stored in the encrypted folder? Yes/No

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Control \| Check \| Evidence \| Checked by \| Date		AA failed check was recorded but never fixed or rechecked
2MFA on staff accounts \| Yes \| Screenshot of settings \| J. Lee \| 12/09		BOne completed checklist line: one control, a passed check, evidence, the checker and the date
3Each checklist line should record the evidence that proves the control is in place		CThe column headings of an implementation checklist, which record each control, its yes/no result, proof, who checked it and when
4A failed item is fixed, then rechecked and recorded again		DThree controls are combined on one line, and there is no evidence, checker or date
5Passwords, MFA and backups \| Yes		EEncryption on laptops \| No \| Fix: turn on encryption, recheck 14/09
6Firewall enabled \| No \| (left as it is)		FBackup runs nightly \| Yes \| Log file 12-09.txt

Definitions

implementation checklist

Fill in the Blanks

Complete each line of code by filling in the missing parts.

=_______(C2:C9,"No")

=__(C2="Yes","Pass","Fix")

=COUNTIF(C2:C9,"Yes")_COUNTA(A2:A9)

=IF(C2="Yes",_____(),"")

=IF(COUNTIF(C2:C9,"No")_0,"All done","Fix")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Control: Turn on MFA

B Check: Is MFA on? Maybe

C Evidence: Screenshot of login

D Checked by: Sam, 12 Mar

Question 2

A Control: Backup, encrypt

B Check: Backup ran? Yes

C Evidence: Log shows 2am run

Question 3

A Control: Encrypt laptops

B Evidence: I think it is on

C Check: Yes

D Checked by: Mia, 3 Apr

Question 4

A Control: Install antivirus

B Check: Is it installed? Yes

C Evidence: Scan report saved

D Checked by: Leo

Question 5

A Control: Improve security

B Check: Is minimum 12? Yes/No

C Evidence: Policy settings page

Answer Key

Using a checklist to confirm security controls are implemented

Section A: Quick Questions

B — One control per line, each with its own yes/no check

A — Screenshot of the login asking for a code after the password

A — Who checked the control and the date it was checked

A — Fix the control, then check it again and record the new result

B — Is the backup file stored in the encrypted folder? Yes/No

Section B: Match the Pairs

Control | Check | Evidence | Checked by | Date → The column headings of an implementation checklist, which record each control, its yes/no result, proof, who checked it and when

MFA on staff accounts | Yes | Screenshot of settings | J. Lee | 12/09 → One completed checklist line: one control, a passed check, evidence, the checker and the date

Each checklist line should record the evidence that proves the control is in place → Backup runs nightly | Yes | Log file 12-09.txt

A failed item is fixed, then rechecked and recorded again → Encryption on laptops | No | Fix: turn on encryption, recheck 14/09

Passwords, MFA and backups | Yes → Three controls are combined on one line, and there is no evidence, checker or date

Firewall enabled | No | (left as it is) → A failed check was recorded but never fixed or rechecked

Section C: Definitions

implementation checklist — A list with one security control per line, a yes/no check and evidence, plus who checked and when, used to confirm each control was set up correctly and to fix any failed items.

Section D: Fill in the Blanks

=COUNTIF(C2:C9,"No")

=IF(C2="Yes","Pass","Fix")

=COUNTIF(C2:C9,"Yes")/COUNTA(A2:A9)

=IF(C2="Yes",TODAY(),"")

=IF(COUNTIF(C2:C9,"No")=0,"All done","Fix")

Section E: Spot the Error

B — Each check on an implementation checklist must be a clear yes/no answer. 'Maybe' does not confirm anything. It should read 'Check: Is MFA on? Yes/No'.

A — A checklist has one control per line. Backup and encryption are two controls, so each needs its own line. The line should be 'Control: Daily backup'.

B — Evidence must be proof that others can look at, such as a screenshot. An opinion is not evidence. It should be 'Evidence: Settings screenshot'.

D — The checklist must record who checked and when. The date is missing. It should be 'Checked by: Leo, 5 May'.

A — Each control must be specific so it can be checked with a yes/no answer. 'Improve security' is too vague. It should name the control, such as 'Control: Min password 12 chars'.