Visibility & ownership
1. We maintain an authoritative inventory of security-relevant assets or systems.
0 · No1 · Partial2 · Yes
2. Material assets have accountable business or technical owners.
0 · No1 · Partial2 · Yes
3. Security events and findings can be connected to the affected asset or owner.
0 · No1 · Partial2 · Yes
4. We can distinguish source-system data from our authoritative operating record.
0 · No1 · Partial2 · Yes
Triage & incident response
1. Alert triage criteria are documented and applied consistently.
0 · No1 · Partial2 · Yes
2. We can escalate material activity into an incident with explicit ownership and severity.
0 · No1 · Partial2 · Yes
3. Incident response tasks and playbooks are available during an event.
0 · No1 · Partial2 · Yes
4. We preserve a reliable timeline of decisions, actions and evidence.
0 · No1 · Partial2 · Yes
Exposure & remediation
1. Vulnerabilities are prioritised using more than technical severity alone.
0 · No1 · Partial2 · Yes
2. Exposure treatment has accountable owners and due dates.
0 · No1 · Partial2 · Yes
3. Accepted or mitigated findings retain rationale and review history.
0 · No1 · Partial2 · Yes
4. Remediation closure can be supported by verification evidence.
0 · No1 · Partial2 · Yes
Evidence & assurance
1. Control evidence has an identifiable source, owner and review status.
0 · No1 · Partial2 · Yes
2. Operational findings can be linked to risk, control or assurance records where relevant.
0 · No1 · Partial2 · Yes
3. Exceptions and compensating actions are explicitly recorded.
0 · No1 · Partial2 · Yes
4. Audit or review evidence can be reproduced without rebuilding it from email and screenshots.
0 · No1 · Partial2 · Yes
Measurement & learning
1. We measure ageing and ownership of unresolved material security work.
0 · No1 · Partial2 · Yes
2. Post-incident lessons lead to tracked changes in playbooks, controls or operating practice.
0 · No1 · Partial2 · Yes
3. Security exercises test actual workflows and records, not only discussion.
0 · No1 · Partial2 · Yes
4. Management reporting can be traced back to current operational records.
0 · No1 · Partial2 · Yes
Interpret the total carefully
0–13
Reactive
Core security work is likely dependent on manual reconstruction and individual knowledge.
14–25
Developing
Important records and workflows exist, but ownership, evidence or consistency remain uneven.
26–33
Operational
Most security workflows are repeatable, with identifiable gaps to connect or automate.
34–40
Evidence-led
Security operations, ownership, evidence and reporting are substantially connected and repeatable.
What this score does not mean
The checklist is a first-party self-assessment aid. A higher score does not prove security effectiveness, compliance or lower breach probability, and the checklist is not an independent audit.