Self-assessment

Security baseline assessment.

Fifteen statements across five domains, drawn from the NIST Cybersecurity Framework 2.0 and the CIS Critical Security Controls. Indicate how well each describes your organization today to receive a summary by domain and a prioritized list of next steps.

About 5 minutes · Answers are processed in your browser and are not stored or sent

Identity and access

Multi-factor authentication is enforced for all workforce, administrator and remote access, including email and cloud consoles.
Privileged accounts are separate from day-to-day accounts, limited in number and reviewed at least quarterly.
Access is removed within one business day when an employee or contractor leaves or changes role.

Infrastructure and network

A current inventory exists of hardware, software and cloud services, with an owner recorded for each.
Critical security patches are applied to internet-facing systems within 14 days of release.
The network is segmented so that a compromised workstation cannot reach critical systems directly.

Data protection and recovery

Backups of critical systems are immutable or held offline, and isolated from production credentials.
Restoration of a critical system from backup has been tested within the past 12 months.
Sensitive data is classified, and encrypted both at rest and in transit.

Detection and response

Security logs from identity, endpoint, network and cloud platforms are collected centrally and retained for at least 90 days.
Alerts are monitored and triaged around the clock, by an internal team or a managed provider.
An incident response plan with named roles exists and has been exercised within the past 12 months.

Governance and third parties

Cybersecurity risk is reported to executive leadership or the board on a regular schedule.
Third-party and vendor access is inventoried, limited to what is necessary and reviewed at least annually.
Employees complete security awareness training at least annually, including simulated phishing.

0 of 15 answered

Next step

Review the results with a specialist.

A Meridyn security architect can walk through your summary, test the assumptions behind it and help you sequence the improvements.

Talk to an expertRead our insights