Free Workbook
Eighty questions across ten areas. Every control is asked twice: do you do this, and could you prove it today. The distance between those two answers is what an assessment measures, and you can measure it yourself in an afternoon.
Most self-assessments ask whether you have a control. You answer yes, because you do, and the result tells you what you already believed. It is the second question that does the work: could you show somebody, today, without preparing first.
The gap between those two answers is almost always wider than people expect, and it is the gap a customer questionnaire, an insurer or a regulator lands in. Finding it yourself costs an afternoon. Finding it under a deadline costs considerably more.
You answer. The workbook scores, ranks and writes the action list, so nothing depends on you interpreting your own answers.
Nine questions about size, sites, card payments, who runs your IT and what data you hold. These switch off the questions that do not apply, so you are not scored against controls you have no reason to have.
Eighty questions, each with a line explaining why it matters and what usually goes wrong. Answered with dropdowns, not free text, so the scoring works.
Calculated, not typed. How many controls you believe are in place, how many you could prove, and the gap between them, which is the number to read first.
The twenty highest-priority items, ranked automatically from your answers. Not a list of everything wrong, a list of what to do on Monday.
A fictional supermarket chain, filled in, scored, and annotated with what a real assessment found afterwards. Read it first if you want to see where this goes.
Document control block, identifier and version, so it reads as a controlled document rather than a spreadsheet somebody made. Board packs and insurers care about that.
Ten areas, weighted by how often each one is the thing somebody actually asks about.
| Area | Questions |
|---|---|
| 1. Who is in charge of security | 7 |
| 2. Your IT provider and suppliers | 8 |
| 3. Knowing what you have | 7 |
| 4. Who can get into your systems | 11 |
| 5. Your people | 6 |
| 6. Protecting your information | 9 |
| 7. Card payments and customer data | 6 |
| 8. Spotting and handling problems | 9 |
| 9. Keeping the business running | 9 |
| 10. Checking it still works | 8 |
Each question carries a line explaining why it matters and what usually goes wrong, so the workbook is readable by somebody who is not a security specialist. That is deliberate: the person who has to answer a customer questionnaire usually is not one.
Nobody scores badly on the first question. Organizations do this and mean it. The second column is where the surprise lives, and it is not a failure of effort: it is that nobody has ever been asked to produce the evidence, so nobody has checked whether it exists.
That is the entire argument for an assessment, and you can test it on yourself before speaking to anybody.
Forty-five minutes on what your result actually means and which two or three things are worth doing first. No obligation, and if our answer is that you do not need a paid engagement this quarter, that is what you will hear.
Also useful: The other thirteen downloads · Security Health Check · Where we are the wrong answer