AEM Cyber Security Education Survey

1. What best describes your current role?

• C-level Management
• IT Management
• IT System Administrator
• Other - Please Specify Please enter an 'other' value for this selection.

2. What is your primary industry?

• Agriculture
• Construction
• Mining
• Utility
• Forestry

3. What is the size of your organization?

• <$10m
• $10m to <$50m
• $50m to <$200m
• $200m to <$500m
• $500m <$1b
• $1b<$5b
• $5b<$10b
• $10b+

4. How many employees does your company employ?

• 1-100
• 101-250
• 251-500
• 501-1,000
• 1,001 or more

5. . What operating system(s) and versions are in your environment? (Check all that apply)

• Windows (versions)
• Linux (distributions)
• Other - Please specify Please enter an 'other' value for this selection. * This question is required.

5. Do you manage any cloud services? (check all that apply)

• AWS
• GCP
• Azure
• Other - Please specify Please enter an 'other' value for this selection. * This question is required.

5. How likely is cybersecurity to be addressed in Executive Meetings?

Very likely	Likely	Occasionally	Unlikely	Very unlikely
Very likely	Likely	Occasionally	Unlikely	Very unlikely

5. What is the level of engagement of the Executive Management in managing cybersecurity risks?

Very high	High	Neutral	Low	Very low
Very high	High	Neutral	Low	Very low

5. Do you or your company have any past experience with cyber-incidents?

• No incidents
• Minor incident(s)
• Major incident(s)
• Severe/Crippling incident(s)
• Unknown

7. Rank the top 3 business priorities tied to managing cyber risk within your organization (1 being the highest priority) Note: for the following table each column is restricted to a single answer across all rows.

	1	2	3
Protecting your organization's brand/reputation	Rank Protecting your organization's brand/reputation as 1 out of 3	Rank Protecting your organization's brand/reputation as 2 out of 3	Rank Protecting your organization's brand/reputation as 3 out of 3
Guarding against data / IP theft	Rank Guarding against data / IP theft as 1 out of 3	Rank Guarding against data / IP theft as 2 out of 3	Rank Guarding against data / IP theft as 3 out of 3
Maintaining compliance	Rank Maintaining compliance as 1 out of 3	Rank Maintaining compliance as 2 out of 3	Rank Maintaining compliance as 3 out of 3
Minimizing business disruption	Rank Minimizing business disruption as 1 out of 3	Rank Minimizing business disruption as 2 out of 3	Rank Minimizing business disruption as 3 out of 3
Limiting legal liability	Rank Limiting legal liability as 1 out of 3	Rank Limiting legal liability as 2 out of 3	Rank Limiting legal liability as 3 out of 3
Reducing cost to recover/restore in the event of a breach.	Rank Reducing cost to recover/restore in the event of a breach. as 1 out of 3	Rank Reducing cost to recover/restore in the event of a breach. as 2 out of 3	Rank Reducing cost to recover/restore in the event of a breach. as 3 out of 3
Enabling your business (client / prospect confidence)	Rank Enabling your business (client / prospect confidence) as 1 out of 3	Rank Enabling your business (client / prospect confidence) as 2 out of 3	Rank Enabling your business (client / prospect confidence) as 3 out of 3
Ensuring safety (human life)	Rank Ensuring safety (human life) as 1 out of 3	Rank Ensuring safety (human life) as 2 out of 3	Rank Ensuring safety (human life) as 3 out of 3

8. Please select the level of cybersecurity maturity within your organization.

• Initial – (Information Security processes may be unstructured. Processes would not be sufficiently defined and documented to allow them to be replicated.)
• Developing – (Information Security efforts are at a repeatable level where basic project management techniques are established, and successes can be repeated. This is due to processes being established, defined, and documented.)
• Defined – (Information Security efforts have greater attention to documentation, standardization, and maintenance support.)
• Managed – (Organization monitors and controls its own Information Security processes through data collection and analysis.)
• Optimized – (Information Security processes are constantly being improved through monitoring feedback from existing processes and introducing new processes to better serve the organization’s particular needs.)

9. How confident are you that your organization is prepared for cyber-incidents

Very Confident	Confident	Neutral	Not Confident	Not at all Confident
Very Confident	Confident	Neutral	Not Confident	Not at all Confident

10. How would you rate the capability of your Incident Response Plan in care of an incident?

Very Capable	Capable	Neutral	Not Capable	Not at all Capable	No Incident Response Plan in place
Very Capable	Capable	Neutral	Not Capable	Not at all Capable	No Incident Response Plan in place

11. Does your organization have a Chief Information Security Officer/Chief Security Officer?

• Yes
• No

12. If yes, is their role dedicated, shared or outsourced?

• Dedicated
• Shared (i.e., Chief Technology Officer is also responsible for Security)
• Outsourced (i.e., to strategic partner)

12. Who does this role report to?

• CEO
• CFO
• COO
• CIO
• Other - Please specify Please enter an 'other' value for this selection.

12. If no, who is responsible for Security in your organization?

• CTO
• IT Manager
• CFO
• CIO
• Other - Please specify Please enter an 'other' value for this selection.

12. What is the approximate Security Budget Allocation as a % of Gross Revenue in your organization?

• Less than 0.5%
• 0.5 to <1%
• 1% to <2%
• 2% to <3%
• 3% to <4%
• 4% to <5%
• 5% or more
• Unknown

13. Are your organization's security budgets adequate to secure your organization effectively

• Yes
• No

14. What security technologies/controls do you have in place? (Check all that apply)

• Basic Firewall
• Next-Gen Firewall
• Next-Gen Endpoint Protection
• Data Loss Prevention
• SIEM
• Security Operations Center
• 24/7 Monitoring
• Outsourced Managed Detection & Response
• Single Sign-on
• Proactive Patch Management
• Vulnerability Scanning
• Risk Management Team
• Incident Response / Crisis Management Plans
• PenTesting
• Risk Assessments
• 3rd Party Vendor Assessments

14. What cyber threat are you most concerned about within your organization? (1 being the most concerned) Note: for the following table each column is restricted to a single answer across all rows.

	1	2	3	4	5	6	7	8
Ransomware	Rank Ransomware as 1 out of 8	Rank Ransomware as 2 out of 8	Rank Ransomware as 3 out of 8	Rank Ransomware as 4 out of 8	Rank Ransomware as 5 out of 8	Rank Ransomware as 6 out of 8	Rank Ransomware as 7 out of 8	Rank Ransomware as 8 out of 8
Service disruption (sales, manufacturing, supply chain)	Rank Service disruption (sales, manufacturing, supply chain) as 1 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 2 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 3 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 4 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 5 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 6 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 7 out of 8	Rank Service disruption (sales, manufacturing, supply chain) as 8 out of 8
Website defacement	Rank Website defacement as 1 out of 8	Rank Website defacement as 2 out of 8	Rank Website defacement as 3 out of 8	Rank Website defacement as 4 out of 8	Rank Website defacement as 5 out of 8	Rank Website defacement as 6 out of 8	Rank Website defacement as 7 out of 8	Rank Website defacement as 8 out of 8
System outage/failure	Rank System outage/failure as 1 out of 8	Rank System outage/failure as 2 out of 8	Rank System outage/failure as 3 out of 8	Rank System outage/failure as 4 out of 8	Rank System outage/failure as 5 out of 8	Rank System outage/failure as 6 out of 8	Rank System outage/failure as 7 out of 8	Rank System outage/failure as 8 out of 8
Account fraud (phishing) - paying an invoice to the wrong account etc.	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 1 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 2 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 3 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 4 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 5 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 6 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 7 out of 8	Rank Account fraud (phishing) - paying an invoice to the wrong account etc. as 8 out of 8
Equipment software hacking	Rank Equipment software hacking as 1 out of 8	Rank Equipment software hacking as 2 out of 8	Rank Equipment software hacking as 3 out of 8	Rank Equipment software hacking as 4 out of 8	Rank Equipment software hacking as 5 out of 8	Rank Equipment software hacking as 6 out of 8	Rank Equipment software hacking as 7 out of 8	Rank Equipment software hacking as 8 out of 8
End user Data Privacy	Rank End user Data Privacy as 1 out of 8	Rank End user Data Privacy as 2 out of 8	Rank End user Data Privacy as 3 out of 8	Rank End user Data Privacy as 4 out of 8	Rank End user Data Privacy as 5 out of 8	Rank End user Data Privacy as 6 out of 8	Rank End user Data Privacy as 7 out of 8	Rank End user Data Privacy as 8 out of 8
Theft of Intellectual Property	Rank Theft of Intellectual Property as 1 out of 8	Rank Theft of Intellectual Property as 2 out of 8	Rank Theft of Intellectual Property as 3 out of 8	Rank Theft of Intellectual Property as 4 out of 8	Rank Theft of Intellectual Property as 5 out of 8	Rank Theft of Intellectual Property as 6 out of 8	Rank Theft of Intellectual Property as 7 out of 8	Rank Theft of Intellectual Property as 8 out of 8

15. Which external drivers have the greatest influence on cyber-security initiatives within your organization?

• Dealers
• Supply Chain
• Customers
• Regulatory

16. Who do you see as the most likely threat actors for your business? (i.e., People who want to do you harm either advertently or inadvertently?)

• Foreign states
• Disgruntled employees
• Unsuspecting employees
• Manufacturer negligence
• Supplier negligence
• Dealer negligence
• Hackers
• Activists
• Competitors