Security Maturity Assessment

Access Control

How is multi-factor authentication enforced across your organization?

Not enforcedEnforced for admins onlyEnforced for all privileged accountsEnforced org-wide with hardware keys or passkeys

How are third-party or vendor access privileges managed?

No formal processManual review on requestTime-boxed access with periodic reviewJust-in-time access with a full audit trail

Data Protection

Is sensitive data encrypted at rest and in transit?

InconsistentlyIn transit onlyAt rest and in transitEnd-to-end, with a formal key management program

How is data classified and handled across its lifecycle?

No classificationInformal classificationDocumented classification with handling rulesAutomated classification and DLP enforcement

Incident Response

Do you have a documented incident response plan?

No planInformal planDocumented plan, tested annuallyDocumented plan with regular tabletop exercises

How quickly can you detect and respond to a security incident?

No formal monitoringManual log reviewAutomated alerting with defined SLAs24/7 SOC with automated response

Compliance & Governance

What compliance frameworks does your organization currently align with?

NoneWorking toward oneAligned with one major frameworkAligned with multiple frameworks, audited annually

How often is your security posture independently assessed?

NeverAd hocAnnuallyContinuously, via pentesting or red-teaming

Where does your security program stand?