Free Cybersecurity Assessment

Quick 5-minute security check - Get your score instantly

No credit card required
Industry benchmarking included
Your data is secure and will never be shared
Required for accurate industry benchmarking and comparison
Section 1 of 3: Security Leadership

Instructions: Click on one cell per row that best describes your organization. Your score updates automatically as you select options.

Assessment Progress:
0%
Your Current Score: 0/150
Component Level 1 Level 2 Level 3
1.1 Management Awareness
Leadership Engagement Management has minimal awareness of cybersecurity requirements Basic recognition of security importance from leaders Regular security updates to management team
Security Governance No formal governance structure Basic security committee established Formal security governance framework with defined roles
1.2 Risk Management
Risk Assessment Risk identification is reactive and ad-hoc Basic qualitative risk assessment (High/Medium/Low) Documented risk assessment methodology
Compliance Management Reactive approach to regulatory requirements Basic awareness of key regulatory requirements Formal compliance program established
Component Level 1 Level 2 Level 3
2.1 Access Management
Access Control Policy No formal access control policy Basic access policy exists but not role-based Documented Role-Based Access Control (RBAC) policy
Access Review No regular access reviews Inconsistent access removal for departing employees Regular user access reviews (at least semi-annual)
2.2 Authentication
Multi-Factor Authentication No MFA implementation MFA for critical systems only MFA required for all external access
Password Management Basic password policies (minimum length only) Password complexity requirements enforced Advanced password policies with regular rotation
Component Level 1 Level 2 Level 3
3.1 Training Program
Security Awareness No formal security awareness program Basic security awareness training program Comprehensive security awareness program
Training Frequency Training limited to annual compliance requirement Annual mandatory security training Quarterly security awareness communications
3.2 Phishing Defense
Phishing Simulations No phishing simulation tests Occasional phishing tests without targeted follow-up Regular phishing simulations with metrics
Incident Reporting No clear reporting channels for security concerns Some incident reporting channels established Clear incident reporting channels for all employees