Click any section below to preview or revisit your answers.
1. Organization Profile
Tell us about your organization.
Business Context Your organization in context
2-4 sentences describing what you deliver, to whom, and scale.
List the processes or services that must stay online.
Press Enter after each industry to add a chip.
Skip this if it doesn't apply. If it does, a few words about what makes you unique helps us tailor risk priorities.
Technical Architecture Your IT environment
What kinds of software your business runs or builds.
Pick the closest match. If you're not sure, "Flat" is the honest answer for many small businesses.
A quick list helps us tailor policies to your actual stack. Bullets or sentences both work.
Client Data Lifecycle Where client data lives
Add a brief system or location for each stage (e.g., Store = AWS S3; Dispose = NIST 800-88 sanitization).
Risk Management Framework Risk tolerance, acceptance, and enterprise-risk linkage
Structured Data Flows How data moves through your business
Identify major sources→stores→movements (e.g., endpoints → S3 → ETL → warehouse).
Risk & Compliance Requirements Regulatory and contractual obligations
Note any SLAs, audit rights, or security addenda.
List the top known risks or open issues (no placeholders).
Stakeholders & Risk Appetite Risk ownership and escalation
How comfortable is leadership with taking security/operational risk?
Governance & Programs Policies, awareness, and oversight
Select all formal policies currently maintained.
KPIs quantify program health (e.g., MTTR, patch SLAs, phishing click rate).
Which best describes how AI is used today? Select all that apply.
Select controls in place for facilities where company assets or data are stored.
Highlight activities that keep custom code secure.
Capture controls that protect email and collaboration platforms.
Security Awareness Program Training delivery, phishing simulations, and security champions
Operations & Change Management Clarify how changes and incidents are handled
Secure Development & Platform Security Software development lifecycle, security gates, and change control
2. Infrastructure & Technology
Understand your IT environment.
Indicate how mobile devices (laptops, tablets, phones) are onboarded and controlled.
3. Access & Authentication
How do you manage user access?
Select all that apply
Estimate what percentage of your workforce must use MFA across key systems.
Identity Lifecycle Management How identities are managed from hire to exit
4. Asset Management & Data
How do you track and protect critical assets?
Select the safeguards that govern how encryption keys are generated, stored, rotated, and retired.
Identify how portable storage (USB drives, external disks) is governed.
5. Vulnerability & Patch Management
Identify and remediate weaknesses.
6. Monitoring & Detection
How do you detect/respond to threats?
Security Operations Details Day-to-day monitoring and response
Detection & Monitoring Enhancements SIEM, behavioral baselines, and incident criteria
7. Backup & Recovery
Recover from data loss or ransomware.
Auto-filled from Section 1; RTO is the maximum downtime your business can tolerate.
Auto-filled from Section 1; RPO is the maximum acceptable data loss window.
8. Incident Response & Breach History
Detect, respond, and learn from incidents.
Incident Response Program Details Response standards and readiness
Communications & External Relations Incident notifications, internal and external
9. Third-Party Risk Management
Manage security risks from vendors/partners.
Critical Vendor Details Key vendors, data handling, and assurances
Press Enter after each vendor; select a chip to edit details.
Add a vendor above, then select it to capture category, services, data access, and requirements.
Example: Annual SOC 2 Type II; 24-hour breach notification; right-to-audit clause.
Cyber Insurance Coverage, limits, and insurer expectations
Expanded Third-Party Risk Vendor onboarding, ongoing monitoring, and offboarding
10. Business Continuity & Risk
How resilient is your organization?
BCP explains how you keep critical services running during major disruptions.
DR plans describe how you restore systems and data after a severe outage.
Compliance & Audit Assurance activities and exception handling
Metrics & Continuous Improvement Key indicators, cadence, and roadmap ownership
KRIs flag when risk is increasing so leadership can act early.
KPIs measure ongoing program performance (e.g., MTTR, training completion).
11. Supporting Documents Optional
Add files or screenshots to make your report and policies more specific, or skip this step entirely.
Your typed answers are everything we need to build your report. This step is an optional bonus: if you have any of the items below handy, our system reads them to pull in concrete details (named systems, vendors, dates, and observed gaps) that make your results and policies sharper. Don't have something? Just skip it.
Processed in memory, never saved. Our system reads each file only to generate your report and policies, then discards it the moment processing finishes. Nothing you upload is written to disk, stored on our servers, or used to train AI.
Building your report
Scoring your responses…
Your Cybersecurity Maturity Report
Personalized assessment of your organization's NIST CSF 2.0 implementation posture.
Your assessment is ready.
Executive Summary
Your executive summary will appear once scoring completes.
CSF 2.0 Function Coverage
Govern wraps the five operational functions in NIST CSF 2.0. Filled wedges show your current maturity across each function.
Implementation Tier Ladder
NIST defines four implementation tiers. The marker shows where your responses place your organization today.
Function Performance & Gap Analysis
Implementation Tier Analysis
Scoring your responses…
What this assessment is based on
- Analysis pending…
What We Found
The gaps your responses surfaced, ordered by severity. Each maps to a NIST CSF 2.0 subcategory.
Unlock your full report and policy suite
Your complete assessment report plus up to ten security policy documents, tailored to your responses.
- Full NIST CSF 2.0 assessment report
- AI-scored maturity across all six functions
- Up to 10 customized security policies (.docx)
- Tailored to your industry and size
- Prioritized findings mapped to NIST CSF 2.0
- Instant download, yours to keep
Policies: Information Security, Acceptable Use, Access Control, Data Classification, Logging & Monitoring, Incident Response, Backup & Recovery, Vendor Risk Management, Vulnerability & Patch Management, Secure Development (SDLC).
Every answer is written to this browser's storage on this device the moment you type it. Nothing is sent to our servers until you generate your report.
To keep your progress, continue in the same browser on the same device.
Progress is lost if you clear browsing data, use private or incognito mode, switch browsers or devices, or have a privacy extension that wipes site storage.