How to Use This Assessment

Score your organization on a 1–5 scale for each dimension. A score of 1 indicates critical gaps; 5 indicates mature, optimizing security practices. Sum scores for a total out of 35.

Complete this assessment with input from security, IT operations, facilities, legal, and business leadership. Security assessments completed by a single person consistently miss gaps outside their area of expertise.

Dimension 1: Governance

Scoring Rubric

• 1 — No governance: No security policies. No security leadership. No risk management process.
• 2 — Basic: Some security policies exist. Security responsibility assigned. Basic risk awareness.
• 3 — Defined: Comprehensive security policies. CISO or equivalent. Formal risk management process. Security metrics reported to leadership.
• 4 — Managed: Board-level security oversight. Risk-based security investment decisions. Security integrated into business processes.
• 5 — Optimizing: Continuous improvement culture. Security metrics drive decisions. Proactive threat intelligence integration.

Dimension 2: Asset Management

Scoring Rubric

• 1 — Unknown: No asset inventory. Unknown attack surface. No vulnerability management.
• 2 — Partial: Partial asset inventory. Some vulnerability scanning. Manual processes.
• 3 — Managed: Complete asset inventory. Regular vulnerability scanning. Patch management process.
• 4 — Advanced: Automated asset discovery. Continuous vulnerability scanning. Risk-based patch prioritization.
• 5 — Optimizing: Real-time asset visibility. Automated patch deployment. Attack surface management platform.

Key Questions

• Do you have a complete inventory of all hardware and software assets?
• Do you scan for vulnerabilities regularly?
• Do you have a patch management process with defined SLAs by severity?
• Do you know your external attack surface (internet-facing systems)?

Dimension 3: Access Controls

Scoring Rubric

• 1 — Minimal: Shared accounts. No MFA. No access reviews. Excessive privileges.
• 2 — Basic: Individual accounts. MFA for some users. Infrequent access reviews.
• 3 — Standard: MFA for all users. Regular access reviews. Least privilege enforced. PAM for privileged accounts.
• 4 — Advanced: Phishing-resistant MFA for privileged access. Just-in-time access. Conditional access policies. Zero trust network access.
• 5 — Optimizing: Continuous access verification. Automated access reviews. Full zero trust identity implementation.

Key Questions

• Is MFA required for all users? For all remote access?
• Are access rights reviewed regularly and revoked when no longer needed?
• Is privileged access managed through a PAM solution?
• Are service accounts and shared accounts minimized?

Dimension 4: Threat Detection

Scoring Rubric

• 1 — Blind: No security monitoring. No logging. Incidents discovered by users or external parties.
• 2 — Basic: Some logging. Basic alerting. No 24/7 monitoring.
• 3 — Functional: SIEM deployed. EDR on endpoints. 24/7 monitoring (in-house or MSSP). Defined alert response procedures.
• 4 — Advanced: NDR for network visibility. Threat hunting capability. Threat intelligence integration. Low mean time to detect.
• 5 — Optimizing: XDR platform. Automated detection and response. Continuous threat hunting. Sub-hour MTTD for critical threats.

Dimension 5: Incident Response

Scoring Rubric

• 1 — Ad hoc: No incident response plan. No trained team. No communication procedures.
• 2 — Basic: Basic incident response plan. Some training. Informal communication procedures.
• 3 — Defined: Documented IR plan with playbooks. Trained IR team. Regular tabletop exercises. IR retainer in place.
• 4 — Advanced: Comprehensive playbooks for all major incident types. Regular functional exercises. Tested backup recovery. Regulatory notification procedures documented.
• 5 — Optimizing: Continuous IR improvement. Red team exercises. Automated response capabilities. Sub-hour MTTR for critical incidents.

Dimension 6: Physical Security

Scoring Rubric

• 1 — Minimal: Basic lock and key. No access logging. No CCTV.
• 2 — Basic: Badge access. Some CCTV. Basic visitor management.
• 3 — Standard: Mantrap entry. Biometric or multi-factor authentication. Full CCTV coverage. Comprehensive visitor management.
• 4 — Advanced: Layered physical security. 24/7 security monitoring. Regular physical security assessments.
• 5 — Optimizing: Physical and cyber security integrated. Regular physical penetration testing. Continuous improvement.

Dimension 7: Compliance

Scoring Rubric

• 1 — Non-compliant: No compliance program. Applicable regulations unknown. No audit capability.
• 2 — Aware: Applicable regulations identified. Compliance gaps known. Remediation in progress.
• 3 — Compliant: SOC 2 Type II or equivalent. Compliance program active. Annual audits completed.
• 4 — Advanced: Multiple certifications (SOC 2, ISO 27001). Continuous compliance monitoring. Automated evidence collection.
• 5 — Optimizing: Comprehensive compliance program. Proactive regulatory engagement. Compliance integrated into development and operations.

Scoring & Next Steps

Any dimension scoring 1 is a critical gap requiring immediate attention. Access controls at score 1 (no MFA) is the highest-risk gap — implement MFA before any other security investment.

DCS Global's Security Assessment provides a detailed evaluation of your security posture with specific remediation recommendations, prioritized by risk. Contact our security team to schedule an assessment.