Free · FRM-RDY-001
Eighty questions across ten areas. Every control is asked twice: do you do this, and could you prove it today. The distance between those two answers is the thing that decides how a questionnaire, an insurer or an audit actually goes.
Why twice
Most self-assessments ask whether you have a control. That is the easy question, and almost everyone says yes. The one that decides a questionnaire, an insurance renewal or an audit is whether you could put the evidence in front of someone this afternoon.
What is in it
Nine questions about size, sites, card payments, who runs your IT and what data you hold. These switch off the questions that do not apply, so you are not scored against controls you have no reason to have.
Eighty questions, each with a line explaining why it matters and what usually goes wrong. Answered with dropdowns, not free text, so the scoring works.
Calculated, not typed. How many controls you believe are in place, how many you could prove, and the gap between them, which is the number to read first.
The twenty highest-priority items, ranked automatically from your answers. Not a list of everything wrong, a list of what to do on Monday.
A fictional supermarket chain, filled in, scored, and annotated with what a real assessment found afterwards. Read it first if you want to see where this goes.
Document control block, identifier and version, so it reads as a controlled document rather than a spreadsheet somebody made. Board packs and insurers care about that.
The ten areas
| Area | Questions |
|---|---|
| 1. Who is in charge of security | 7 |
| 2. Your IT provider and suppliers | 8 |
| 3. Knowing what you have | 7 |
| 4. Who can get into your systems | 11 |
| 5. Your people | 6 |
| 6. Protecting your information | 9 |
| 7. Card payments and customer data | 6 |
| 8. Keeping systems protected | 8 |
| 9. Would you notice | 7 |
| 10. If it happened tomorrow | 11 |
Mapped to the six NIST CSF 2.0 functions, including Govern. Questions about card payments switch off if you do not take them, and the same is true of several others.
What people find
The worked example in the workbook is a fictional six-store supermarket chain. It scores 53 of 80 controls believed in place, 15 that could be proved on the day, and eleven questions where nobody in the room knew the answer. That shape is ordinary. The evidence gap is where an assessment, a questionnaire or an insurer will land, and it is almost never where people expect.
When you have a score
Forty-five minutes on the result: what the gap actually means, what we would fix first, and whether any of it needs paying for. If our honest view is that you do not need an engagement yet, we will say so. Plenty of people take the assessment and never speak to us, which is a perfectly good outcome.