Strategic Leadership, Digital Governance and Cybersecurity Resilience in Faith-Based Organizations

Q0.1I have read the participant information and voluntarily agree to participate. *

A1Which PCC operational sector best describes your current role? *

A2What is your current level of responsibility? *

A3How long have you worked with PCC or a PCC institution? *

A4How frequently do you use computers, mobile devices, online platforms or digital systems for your work? *

A5How dependent is your work on digital systems or electronic information? *

A6Have you received formal cybersecurity or information-security training in the past 24 months? *

A7What types of sensitive information do you handle in your work? Select all that apply. *

B1PCC leadership recognizes cybersecurity as an organizational risk, not only an ICT issue. *

B2Senior leaders communicate clear expectations concerning the protection of digital information. *

B3Cybersecurity responsibilities are clearly assigned to appropriate leaders or staff. *

B4Senior management receives information about significant cybersecurity risks affecting PCC operations. *

B5Cybersecurity considerations are included in important organizational decisions involving digital systems. *

B6Adequate financial resources are allocated to cybersecurity and information protection. *

B7Leadership supports regular review and improvement of cybersecurity policies and controls. *

B8There is clear accountability when cybersecurity policies or procedures are not followed. *

B9Cybersecurity risks are considered when new technologies, systems or digital services are introduced. *

B10Leadership treats protection of information as part of its responsibility to PCC members, staff and other stakeholders. *

C1My PCC unit has clear policies or procedures for protecting electronic information. *

C2Staff know where to find the organization's cybersecurity or information-security policies. *

C3Important information assets and digital systems are identified and documented. *

C4Cybersecurity risks are periodically assessed and prioritized. *

C5Critical digital services and information are identified according to their importance to PCC operations. *

C6There are clear procedures for reporting cybersecurity weaknesses or suspected incidents. *

C7Cybersecurity policies are reviewed when significant changes occur in systems, threats or organizational operations. *

C8Cybersecurity requirements are considered when selecting or procuring digital technologies and services. *

C9Cybersecurity performance is monitored using defined indicators, reviews or assessments. *

D1I understand the main cybersecurity risks associated with my work. *

D2I know how to recognize common phishing or social-engineering attempts. *

D3I know what to do if I suspect that an account or device has been compromised. *

D4Staff are encouraged to report suspicious emails, messages, websites or system behavior. *

D5Cybersecurity training is relevant to the actual duties performed by staff. *

D6Staff receive periodic reminders or awareness activities about cybersecurity. *

D7Staff generally take responsibility for protecting the information entrusted to them. *

D8There is a positive organizational culture toward cybersecurity and responsible technology use. *

D9I understand that human behavior can contribute significantly to cybersecurity incidents. *

E1Access to digital systems is limited according to a person's job responsibilities. *

E2User access rights are reviewed when roles or responsibilities change. *

E3Former staff or users have their access removed promptly when they leave or no longer require access. *

E4Strong authentication practices are used to protect important accounts. *

E5Multi-factor authentication is used for important or sensitive systems where available. *

E6Devices used for PCC work receive regular security updates. *

E7Computers and other endpoints are protected against malware and other common threats. *

E8Important systems and networks are appropriately separated or protected from unauthorized access. *

E9Important electronic information is backed up regularly. *

E10Backups are protected from unauthorized access or accidental alteration. *

E11Sensitive information is protected when transmitted or stored using appropriate security measures. *

F1PCC identifies which categories of information require stronger protection. *

F2Access to sensitive personal or institutional information is based on legitimate work requirements. *

F3There are procedures for controlling how sensitive information is shared. *

F4Sensitive information is stored only in approved systems or locations. *

F5There are defined practices for retaining and securely disposing of information when it is no longer required. *

F6Personal and confidential information is handled with appropriate confidentiality safeguards. *

F7Staff understand their responsibilities when handling personal, financial, health, student or executive information. *

F8The organization has mechanisms for identifying and addressing inappropriate access to sensitive information. *

G1PCC evaluates cybersecurity risks before using external digital service providers. *

G2Third-party providers with access to PCC information are subject to appropriate security requirements. *

G3Cloud-based systems used for PCC work are managed with appropriate security controls. *

G4Third-party access to PCC systems or information is limited to what is necessary. *

G5There are procedures for reviewing or ending third-party access when services or contracts change. *

G6Cybersecurity responsibilities are considered in agreements with important technology or service providers. *

H1PCC has clear procedures for detecting or identifying cybersecurity incidents. *

H2Staff know whom to contact when a cybersecurity incident is suspected. *

H3Cybersecurity incidents are documented and reviewed. *

H4There is a defined process for containing and managing cybersecurity incidents. *

H5Important stakeholders know how cybersecurity incidents should be communicated. *

H6PCC has plans for continuing critical operations during a serious technology disruption. *

H7Critical systems and information can be restored following a major disruption. *

H8Backup and recovery arrangements are periodically tested. *

H9Lessons learned from incidents or disruptions are used to improve security. *

I1My PCC unit is prepared to prevent common cybersecurity incidents. *

I2My PCC unit is prepared to detect cybersecurity incidents quickly. *

I3My PCC unit is prepared to respond effectively when a cybersecurity incident occurs. *

I4My PCC unit is prepared to recover important information and services after a cybersecurity incident. *

I5Cybersecurity controls are strong enough to support continuity of critical operations. *

I6The organization can adapt its cybersecurity practices as new threats emerge. *

I7PCC has sufficient organizational capability to manage a significant cybersecurity disruption. *

I8I am confident that my unit could continue essential activities after a serious cyber incident. *

I9Cybersecurity preparedness is improving over time within my area of work. *

J1Overall, how would you rate the maturity of cybersecurity governance in your PCC unit? *

J2Overall, how confident are you in PCC's ability to protect sensitive digital information? *

J3Overall, how prepared is your PCC unit to manage a serious cybersecurity incident? *

K1What do you consider the three most important cybersecurity risks facing your PCC unit? (optional)

K2What is the most important improvement PCC leadership should make to strengthen cybersecurity? (optional)

K3What cybersecurity training or support would be most useful to you? (optional)

K4Are there any other cybersecurity, data-protection or digital-governance issues you believe this study should consider? (optional)