[ READINESS // LEAD MAGNET ]
25-point readiness check
NNSEC · confidential self-assessment
Rate each control 0 (not in place) to 3 (mature). Total score out of 75.
- 01MFA enforced for all privileged accounts
- 02Centralized logging with 90+ day retention
- 03Incident response plan tested in last 12 months
- 04Vulnerability scanning at least monthly
- 05Secrets not stored in source control
- 06Production network segmentation documented
- 07Backup restore tested quarterly
- 08Vendor security reviews for critical SaaS
- 09SOC 2 / ISO gap assessment in last year
- 10Cloud IAM least-privilege reviewed quarterly
- 11EDR or equivalent on 95%+ endpoints
- 12Phishing simulation program active
- 13Data classification policy enforced
- 14Encryption at rest for sensitive data
- 15WAF or equivalent on public apps
- 16Privileged access management for admins
- 17Change management with security review
- 18Board or exec security briefing cadence
- 19DLP or exfil monitoring on email/cloud
- 20Penetration test in last 12 months
- 21Disaster recovery RTO/RPO documented
- 22Third-party pentest/RoE process defined
- 23Security training for all staff annually
- 24Asset inventory accurate within 5%
- 25Named security owner (vCISO or equivalent)