Security Posture Review

Assess your organisation’s current cyber security posture and identify areas where improvements can be made across your people, processes and technology.

Start Your Review

Security Posture Review

Step 1 of 9 - Introduction / Organisation Details

11%

Introduction / Organisation Details

Name(Required)

First Last

Organisation Name(Required)

Email(Required)

Enter Email Confirm Email

Phone(Required)

Job Title

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Typical Evidence / Characteristics
Annual risk assessments; scheduled vulnerability scanning; IR & backup procedures documented and exercised. XDR fully operational and detection and response in place with full reporting and remediation.

Example Indicators
Cyber Essentials Plus achieved or near; ISO 27001 controls largely implemented; change control in place. Monthly / Quarterly reporting with vulnerabilities detected and remediated.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

Board-approved cybersecurity policy in place

Standards (ISO / Cyber Essentials) - ISO 27001 A.5.1; CE

Evidence/Notes

Named security officer (CISO) accountable for risk.

Standards (ISO / Cyber Essentials) - ISO 27001 A.5.2

Evidence/Notes

Annual risk assessments reported to leadership.

Standards (ISO / Cyber Essentials) - ISO 27005; CE+

Evidence/Notes

Comprehensive asset inventory maintained.

Standards (ISO / Cyber Essentials) - ISO 27001 A.8.1; CE

Evidence/Notes

Cyber risk register maintained and updated.

Standards (ISO / Cyber Essentials) - ISO 27005

Evidence/Notes

Supplier and third-party cyber risk assessments performed.

Standards (ISO / Cyber Essentials) - ISO 27036

Evidence/Notes

External audits/certifications achieved (ISO 27001, CE/Plus).

Standards (ISO / Cyber Essentials) - ISO 27001; CE/CE+

Evidence/Notes

Internal cyber audits conducted regularly.

Standards (ISO / Cyber Essentials) - ISO 27001 A.18.2

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

Firewalls, segmentation, IDS/IPS deployed.

Standards (ISO / Cyber Essentials) - ISO 27001 A.13; CE

Evidence/Notes

MFA enforced for remote/privileged access.

Standards (ISO / Cyber Essentials) - ISO 27001 A.9.4; CE

Evidence/Notes

EDR solution deployed across endpoints.

Good practice (EDR)

Evidence/Notes

XDR platform correlates multi-domain data.

Good practice (XDR)

Evidence/Notes

MDR services engaged for 24/7 monitoring.

Good practice (MDR)

Evidence/Notes

Patch management process in place.

Standards (ISO / Cyber Essentials) - ISO 27001 A.12.6; CE

Evidence/Notes

Encryption at rest and in transit.

Standards (ISO / Cyber Essentials) - ISO 27001 A.10.1

Evidence/Notes

Penetration testing performed annually.

Standards (ISO / Cyber Essentials) - ISO 27001 A.12.6; CE+

Evidence/Notes

Vulnerability management with SLAs.

Standards (ISO / Cyber Essentials) - ISO 27001 A.12.6

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

Centralised IAM system in use.

Standards (ISO / Cyber Essentials) - ISO 27001 A.9

Evidence/Notes

Least privilege enforced and regularly reviewed.

Standards (ISO / Cyber Essentials) - ISO 27001 A.9.2

Evidence/Notes

Privileged accounts controlled with PAM.

Standards (ISO / Cyber Essentials) - ISO 27001 A.9.2

Evidence/Notes

Leaver accounts revoked immediately.

Standards (ISO / Cyber Essentials) - CE; ISO 27001 A.9.2

Evidence/Notes

Monitoring for compromised credentials.

Good practice

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

SIEM implemented for log analysis.

Standards (ISO / Cyber Essentials) - CE; ISO 27001 A.12.4

Evidence/Notes

Threat intelligence integrated with SIEM/XDR.

Standards (ISO / Cyber Essentials) - CE; ISO 27001 A.12.4

Evidence/Notes

Threat hunting performed regularly.

Good practice

Evidence/Notes

SLAs defined for alert triage/escalation.

Standards (ISO / Cyber Essentials) - ISO 27035

Evidence/Notes

Red/purple team exercises conducted.

Good practice

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

Incident Response Plan documented (ISO 27035).

ISO 27035

Evidence/Notes

Tabletop IR exercises conducted annually.

ISO 27035

Evidence/Notes

Incident response retainer in place.

Good practice

Evidence/Notes

Backups tested with immutable copies.

ISO 27001 A.12.3; CE+

Evidence/Notes

MTTD/MTTR tracked and improved.

Good practice

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

Annual cybersecurity training for all staff.

ISO 27001 A.7.2; CE

Evidence/Notes

Phishing simulations conducted regularly.

Good practice

Evidence/Notes

Specialised training for executives/admins.

ISO 27001 A.7.2

Evidence/Notes

Cyber awareness maturity measured.

Good practice

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

Compliant with relevant standards (GDPR, ISO, CE, PCI DSS, etc.).

ISO 27001 A.18; CE

Evidence/Notes

Controls mapped to compliance requirements.

ISO 27001 A.18

Evidence/Notes

Compliance/audit logs maintained.

ISO 27001 A.12.4/A.18

Evidence/Notes

1 Initial 2 Developing 3 Defined 4 Managed 5 Optimised

View scoring guidance

Initial (Ad hoc / Reactive)

Definition
Security activity is unstructured and reactive; controls are implemented after incidents.

Typical Evidence / Characteristics
No formal policies; responsibilities unclear; limited logging; backups unreliable; no regular assessments.

Example Indicators
No MFA; no asset inventory; no IR plan; basic AV only; no audits, no CE certification.

Developing (Basic / Emerging)

Definition
Foundational controls exist but are incomplete or inconsistently applied. Some systems implemented but not full coverage.

Typical Evidence / Characteristics
Some policies drafted; informal risk assessments; basic user training; patching inconsistent; limited monitoring.

Example Indicators
Firewalls/AV in place; partial MFA; occasional scans; starting Cyber Essentials journey.

Defined (Established / Formalised)

Definition
Policies, processes and roles are documented and consistently followed. Systems implemented and operational.

Managed (Measured / Integrated)

Definition
Controls are measured for effectiveness and integrated across people, process and technology.

Typical Evidence / Characteristics
EDR/XDR/MDR in place; SIEM with playbooks; regular pen tests; board reporting; supplier due diligence.

Example Indicators
MTTD/MTTR tracked; immutable backups; red/purple team exercises; ISO 27001 certified.

Optimised (Proactive / Resilient)

Definition
Continuous improvement with proactive threat hunting and automation; security is business-as-usual.

Typical Evidence / Characteristics
Intelligence-driven detections; automated response; zero-trust patterns; advanced analytics; supply-chain assurance.

Example Indicators
Hunt operations; attack surface management; continuous control monitoring; frequent exercises; industry leadership.

BCP/DRP documented and maintained.

ISO 22301

Evidence/Notes

BCP/DRP tested against cyber incidents.

ISO 22301

Evidence/Notes

Resilience strategy includes supply chain.

ISO 22301

Evidence/Notes

Name

First Last