Regulatory Risk Score Calculator from hivera

Does your business have a data strategy or an information strategy?*
- Yes, we have a data / information strategy
- No
- Not Sure
If yes, is the data strategy actively applied to your entire unstructured data estate?
- Yes
- No
- Not Sure
Have you carried out a Regulatory Risk Assessment and mapped regulations to risk factors?*
- Yes
- No
- Not Sure
Do you have a solution that automatically identifies and alerts on PII inappropriately stored across your IT infrastructure?*
- Yes
- Yes, but it only covers a subset of our data (i.e. email or a specific archive)
- No
- Not Sure
Do you have a solution that automatically identifies and alerts on Credit Card data (PCI) inappropriately stored across your IT infrastructure?*
- Yes
- Yes, but it only covers a subset of our data (e.g. email or CRM system, etc.)
- No
- Not Sure
How do you currently manage regulatory obligations? Do you have a solution in place that tracks the regulations with which you have an obligation to comply?*
- Yes
- Yes, we have a regulatory catalogue, but it’s not connected to our data; it’s for reference only
- No
- Not Sure
Do you operate across multiple jurisdictions? (please select all that apply)*
- UK
- Europe
- US / Canada
- Middle East
- Asia
- Australia / New Zealand
If you operate across multiple jurisdictions, where do you see the most significant increase in regulations impacting your ability to manage your obligations?
- UK
- Europe
- US / Canada
- Middle East
- Asia
- Australia / New Zealand
How do you manage the relationship between regulations and the associated content they apply to (spreadsheet, data inventory tools etc)?*
- Manual approach, through local data owners
- We use a spreadsheet-based approach that is updated manually
- We use a data inventory tool
- We don't
- Not Sure
How do you identify inappropriately deleted / under-retained data?*
- We have a solution that maintains an index of all of our unstructured data that raises a flag when data is deleted
- We maintain a backup for a period of time (e.g. 30 or 60 days), if someone notices data has been deleted we get it back from there
- We don't
- Not Sure
How do you apply controlled defensible disposition of over-retained data? I.e. to comply with GDPR, CPPA, etc?*
- We delete files but I wouldn’t call it controlled. If we find things that shouldn’t be there, we delete them or tell the business owner to delete them
- We have a process whereby files that are due for disposition or are suspected of being over-retained are flagged to the business owner for approval. Once approved, the files are deleted and an entry added to the disposition log
- We don’t
- Not Sure
How do you currently find data relating to an individual in your unstructured data estate to comply with Subject Access Requests and right to be forgotten requests?*
- We ask the various departments in the business if they have any information on the individual. We collect it and have our team that look after SARs take it from there
- We ask the various departments in the business if they have any information on the individual and get them to send a copy to the people who are asking for the information
- We don’t look in our unstructured data. There is too much of it and trying to find the data would take forever, so we’ve restricted our SAR requests to our structured platforms, such as the CRM system
- What’s a Subject Access Request?
What is your monthly average for the number of incoming DSAR requests*
- Not my department, not sure.
- 0 - we’ve never had anyone request their information or to be forgotten
- 1 - 10
- 10 - 20
- 20 - 50
- 50+
What is your average time to complete a DSAR?*
- Up to 7 days
- 7 - 14 days
- 15 days - 1 month
- Over 1 month
- Not sure
Do you have a data privacy solution?*
- Yes
- No
- Not sure
- In the process of acquiring one
Experience tells us that container files (compressed files, etc.) and password-protected files tend to contain a lot of information that can increase risk; how are you currently managing the risk in these types of file?*
- We have a solution that alerts us to the presence of these types of file and analyses the content (where possible) flagging the risk they contain
- These files are created by users and we push the onus to the user to keep them in order and ensure that they only keep information that they should be keeping, according to our policy
- They haven’t caused us a problem until now, so we’re happy to continue with our current approach and address any problems when they arise
- We don’t have anything in place and haven’t really considered this as an area to be concerned about
Do you know how many different places in your firm that unstructured data is stored? Please choose all that apply*
- File Shares
- SharePoint 2013 or 2016
- Microsoft 365
- Google Suite / Drive
- Documentum
- Enterprise Vault
- Filenet P8
- Not Sure
Do you know if you have a place to keep corporate records (for longer term retention)?*
- Yes, it’s integrated into our business practices and works seamlessly to tag and label our records as we create it
- Yes we have a system in place and we regularly review and file information to it
- Yes we have a system in place, but that’s left for the records managers to manage. If they want information stored in it, they will request it
- We definitely have one; we’re meant to use it but to be honest, it’s a bit convoluted and we’ve so much work to do, no-one takes the time to file information to it
- What's a corporate record?
- Not sure
Name*
Email*
Job Title*

hivera Risk Score Calculator

Risk Score Calculator