Answer 20 quick questions to get your score out of 100. No email or sign-up needed, and your answers never leave your browser.
About this assessment
Find out in five minutes. Answer 20 questions about how your organization protects its accounts, devices, data and people. You will get a readiness score out of 100, your weakest areas and the guides that fix them. Everything is calculated in your browser: no answers are stored or sent anywhere.
This assessment is based on widely used baselines, including the NIST Cybersecurity Framework, the CIS Controls and CISA’s Cross-Sector Cybersecurity Performance Goals. It is a quick self-check, not a formal audit.
How the score works
Each answer scores 2 points for “Yes”, 1 for “Partly” and 0 for “No / not sure”. The total is converted to a score out of 100:
| Score | Rating | What it means |
|---|---|---|
| 80 to 100 | Strong | Core controls are in place; focus on testing and monitoring. |
| 55 to 79 | Developing | Good foundations with gaps attackers commonly exploit. |
| 0 to 54 | At risk | Several basic protections are missing; fix them first. |
What to do with your result
- Fix the priority items first, starting with multifactor authentication, backups and patching. These stop the most common attacks.
- Assign an owner and a date to every gap.
- Repeat the assessment every three to six months to track progress.
- For a formal review, consider an independent cyber security audit.
Want the full picture of controls, certifications and metrics? Read Is Your Business Cybersecurity-Proof? and learn how your data is tracked in the AI era. All our guides are in the cybersecurity guides hub.
Frequently asked questions
Is this assessment free?
Yes. It is free to use as often as you like, and your answers never leave your browser.
Is a high score the same as being certified?
No. The score is a quick self-check. Certifications such as ISO 27001 or SOC 2 require an independent audit with evidence.
Who should take the assessment?
Business owners, IT managers, school administrators and anyone responsible for protecting an organization’s systems and data.