002 ICT security measure used: authentication via biometric methods implemented by the enterprise
003 ICT security measure used: encryption techniques for data, documents or e-mails
004 ICT security measure used: data backup to a separate location (including backup to the cloud)
005 ICT security measure used: network access control (management of access by devices and users to the enterprise's network)
006 ICT security measure used: VPN (Virtual Private Network extends a private network across a public network to enable secure exchange of data over public network)
007 ICT security measure used: maintaining log files for analysis after security incidents
008 ICT security measure used: ICT risk assessment, i.e. periodically assessment of probability and consequences of ICT security incidents
009 ICT security measure used: ICT security tests
00a Enterprises using any ICT security measure
00b ICT security measure used: combination of at least two authentication mechanisms (e.g. user-defined password, one-time password (OTP), code generated via a security token or received via a smartphone, biometric methods)
00c ICT security measure used: monitoring system that allows detecting suspicious activity in the ICT systems and alerts the enterprises about it, other than standalone anti-virus software
00d Enterprises using any ICT security measure (as of 2022)
00e Enterprises using at least 3 ICT security measures (as of 2022)
00f Enterprises using at least 5 ICT security measures (as of 2022)
00g Enterprises using at least 7 ICT security measures (as of 2022)
00h Enterprises using all ICT security measures (as of 2022)
00i The enterprise's ICT security policy was defined or most recently reviewed within the last 12 months
00j The enterprise's ICT security policy was defined or most recently reviewed more than 12 months and up to 24 months ago
00k The enterprise's ICT security policy was defined or most recently reviewed more than 24 months ago
00l The enterprise's ICT security policy was defined or most recently reviewed within the last 24 months
00m Enterprises have document(s) on measures, practices or procedures on ICT security
00n Enterprises make persons employed aware of their obligations in ICT security related issues by voluntary training or internally available information (e.g. information on the intranet)
00o Enterprises make persons employed aware of their obligations in ICT security related issues by compulsory training courses or viewing compulsory material
00p Enterprises make persons employed aware of their obligations in ICT security related issues by contract (e.g. contract of employment)
00q Enterprises make persons employed aware of their obligations in ICT security related issues
00r Enterprises don't make persons employed aware of their obligations in ICT security related issues
00s The ICT security related activities are carried out by the own employees
00t The ICT security related activities are carried out by external suppliers
00u The ICT security related activities are carried out by own employees or external suppliers
00v ICT security measure used: monitoring system used to detect suspicious activity in the ICT systems (e.g. intrusion detection or prevention systems that monitors users’ or devices’ behaviour, network traffic) excluding standalone anti-virus software and default firewall solutions
00w Enterprises make persons employed aware of their obligations in ICT security related issues and have document(s) on measures, practices or procedures on ICT security
Unit of measure
00 Percentage of enterprises
01 Percentage of enterprises with an ICT security policy (as of 2015)
02 Percentage of enterprises with document(s) on measures, practices or procedures on ICT security (as of 2019)
03 Percentage of the enterprises which use a computer
04 Percentage of enterprises where persons employed have access to the internet
Geopolitical entity (reporting)
000 European Union - 27 countries (from 2020)
001 European Union - 28 countries (2013-2020)
002 European Union - 27 countries (2007-2013)
003 European Union - 15 countries (1995-2004)
004 Euro area (EA11-1999, EA12-2001, EA13-2007, EA15-2008, EA16-2009, EA17-2011, EA18-2014, EA19-2015, EA20-2023, EA21-2026)
Security policy: measures, risks and staff awareness by size class of enterprise
methods, notes and classification
Methods 
Variables