Know your cyber risk & security posture now?
ORGANIZATIONAL VISION, STRATEGY & DIRECTION
Assesses strategic maturity and intent — evaluating whether your organization has a clear, documented direction aligned with security objectives.
Does the organization have a documented long-term business vision (3–5 years)?
Are short‑term (annual) and medium‑term (1–3 year) goals formally defined?
Is information security explicitly referenced within the organizational vision or strategy?
Are business goals mapped to technology and security initiatives?
Are KPIs defined to measure progress against strategic objectives?
GOVERNANCE & SENIOR MANAGEMENT INVOLVEMENT
Measures leadership ownership and direction — evaluating senior management's commitment to and involvement in cybersecurity governance.
Does the organization have a formally documented Information Security Policy?
Are all security policies reviewed and updated at least annually?
Is there a dedicated Acceptable Use Policy (AUP) for IT resources?
Does the organization have a documented Data Classification Policy?
Is there a formal Incident Response Policy and plan in place?