Self-audit & readiness

Campus baseline

• Phishing-resistant MFA enforced on privileged accounts; MFA required campus-wide.
• Immutable or offline backups exist for all tier-1 systems and are restored end-to-end at least quarterly.
• Network segmentation isolates research, admin, student, and IoT/lab environments.
• RDP is not exposed to the internet; remote access requires MFA and conditional access.
• Asset and SaaS inventory exists; high-severity third-party CVEs are tracked and acted on.
• EDR is on every endpoint and tied to documented response playbooks.
• Identity-provider hunting checks (impossible travel, OAuth, mailbox rules) run on a schedule.
• Annual tabletop exercise has been completed with cabinet, comms, and legal participation.
• IR retainer, cyber-insurance, legal counsel, and FBI/CISA contacts are documented and current.
• Pre-drafted holding statements, FAQs, and stakeholder lists exist for cyber incidents.
• Out-of-band communication channels (mass notification, off-domain status page) are tested.
• Decision authorities (take systems offline, ransom posture, board comms) are documented.