Sign in Join

Security maturity self-assessment

Twenty-four statements, six domains. Score each 0 (not at all) to 3 (consistently, measured). You get a level per domain and the two domains to fix first. Honest answers only; nobody else sees this unless you share the link.

Everything you type stays in this tab. Share copies a link, never your inputs, unless the tool says it encodes them in the URL.

Identity & access

MFA is enforced for every remote and privileged access path.

Not at allPartlyMostlyConsistently

Joiner, mover, leaver changes reach every system within a day.

Not at allPartlyMostlyConsistently

Privileged accounts are separate, vaulted, and session-recorded.

Not at allPartlyMostlyConsistently

Access is reviewed by owners at least quarterly, with revocations tracked.

Not at allPartlyMostlyConsistently

Endpoint & detection

Every managed endpoint runs EDR with tamper protection, and coverage is measured.

Not at allPartlyMostlyConsistently

Alerts are triaged against a written playbook with defined response times.

Not at allPartlyMostlyConsistently

Detections are tested regularly with adversary emulation or purple-team exercises.

Not at allPartlyMostlyConsistently

Log sources needed for the top ten attack paths are onboarded and monitored.

Not at allPartlyMostlyConsistently

Vulnerability & exposure

Internet-facing assets are inventoried and scanned at least weekly.

Not at allPartlyMostlyConsistently

Critical vulnerabilities on exposed systems are fixed inside a defined SLA, and misses are reported.

Not at allPartlyMostlyConsistently

Patching covers third-party software and firmware, not only the OS.

Not at allPartlyMostlyConsistently

An external attack-surface view is reconciled with the internal inventory.

Not at allPartlyMostlyConsistently

Cloud & data

Cloud accounts have guardrails: no public storage, no root keys, mandatory logging.

Not at allPartlyMostlyConsistently

Sensitive data is classified and its locations are known.

Not at allPartlyMostlyConsistently

Backups are immutable, tested by restore, and separated from production credentials.

Not at allPartlyMostlyConsistently

Secrets live in a vault, not in code or tickets.

Not at allPartlyMostlyConsistently

Governance & vendors

A risk register exists, is owned, and is reviewed with leadership.

Not at allPartlyMostlyConsistently

Third parties with data access are assessed before onboarding and re-assessed on a cycle.

Not at allPartlyMostlyConsistently

Security spending is tied to named risks rather than to renewals.

Not at allPartlyMostlyConsistently

Policies are short, current, and known by the people they apply to.

Not at allPartlyMostlyConsistently

Resilience & response

An incident response plan exists with named roles and was exercised in the last year.

Not at allPartlyMostlyConsistently

Ransomware recovery time is known and has been tested end to end.

Not at allPartlyMostlyConsistently

Legal, communications, and leadership know their part in a breach.

Not at allPartlyMostlyConsistently

Lessons from incidents and near misses change controls within a quarter.

Not at allPartlyMostlyConsistently