Cyber security Maturity Calculator

Analyse your cyber security maturity and find out whether you would benefit from allocating resource to your cyber strategy and digital resilience.

Calculator Part 2

STEP ONE

Compliance and Accreditation

Details on the compliance and accreditation status of the organisation’s IT/IS. Including industry regulation, codes of connection to other organisations and data providers, as well as appropriate accreditation.

Hidden

Lead Email

Hidden

Name

Hidden

Last Name

Hidden

Phone

Is there a defined role in your organisation to manage compliance and accreditation from an Information Security perspective?(Required)

A properly resourced compliance and accreditation function is critical to managing compliance and accreditation in BAU

A compliance and accreditation role exists and is properly resourced and has sufficient influence to successfully manage accreditation

A role exists, but it may be part time or otherwise have some resourcing challenges

Responsibility for accreditation is assumed to sit with the CISO, but this has never been properly defined and elements may sit elsewhere

Responsibility for accreditation is distributed throughout the organisation, but not by design

There is no role defined to manage infosec compliance and accreditation

Has a full review of applicable legislation, regulation and accreditation been undertaken and acted upon?(Required)

Organisations must understand the legislation, regulation and accreditation that applies to them or that gives them competitive advantage and react accordingly

A full understanding has been gained of the required accreditation and applicable regulation, and compliance is used to govern and protect data and operations

A comprehensive review has been undertaken but some findings have not yet been acted upon

Some specific points of regulation and accreditation are understood, but there may be some gaps

We have responded to external request but no review has been undertaken

No such review has been undertaken

Does your organisation comply with ISO 27001:2013?(Required)

ISO 27001:2013 compliance is the de facto standard for many organisations' information security management and often appears in third party service tender responses

Full compliance is in place for the organisation

Formal compliance is in progress for all or part of the organisation, and/or formal compliance is in place for a limited scope

Some working practices are fashioned after ISO 27001:2013 but no formal compliance is in place or desired

ISO 27001:2013 has been considered but is not appropriate for our organisation and no elements have been adopted

ISO 27001:2013 compliance is not in place and has not been considered

Has your organisation reviewed the requirements of the Data Protection Act (2018) and applied controls appropriate to the organisation to ensure that the requirements of the Act are met?(Required)

All organisations should assess the applicability of the DPA to their internal organisation and operations and respond accordingly

A data protection officer is assigned and this role is effectively resourced. Controls, systems and processes are in place to meet the 8 principles

A data protection officer is assigned. Some controls are in place, and a plan is in place to enact other controls to fully meet the 8 principles

A data protection officer is assigned, but this is a part time role. No gap analysis has been completed against the 8 principles, although some controls are thought to be in place.

No data protection officer is specifically assigned. There is some knowledge of the DPA in the organisation, but no formal activity

The DPA has not been considered

Do any of the following bodies govern your cyber security compliance?(Required)

National Cyber Security Centre (NCSC) Cyber Essentials Plus

Payment Card Industry Data Security Standard (PCI DSS)

Financial Conduct Authority (FCA)

Solicitors Regulation Authority (SRA)

National Institute of Standards and Technology (NIST) Cybersecurity Framework

International Organization for Standardization (ISO)

None of the above

More than one of the above

STEP TWO

Technical Compliance

Technical controls are a critical part of cyber security defence. This step measures those controls and assesses their maturity

Does your organisation have hardware and software asset management?(Required)

Asset management is critical to understanding and managing the deployed estate

The organisation has hardware and software asset management with regular updates and discovery. Asset owners are defined

The organisation has either a hardware asset management system or software asset management system but not both. Asset owners are defined

Hardware and software asset management is manual. Asset owners are defined

Hardware asset management is manual, but no software asset management is performed

No asset management is in place

In your organisation is there effective patching and updating according to vendor advice?(Required)

Software patching is a critical security control and out of date patches can present a significant vulnerability

All software is patched within 30 days of an announcement of a critical security vulnerability. A vulnerability tracking and scoring programme is maintained internally

There is a quarterly patching schedule that takes account of all software in the organisation

Some patching is undertaken, but not all software is taken account of (for example, focus is mainly on Microsoft products)

Patching is undertaken on a purely ad-hoc basis and is inconsistent

Patching is not undertaken or is significantly out of date

Does your organisation have an effective access control regime?(Required)

Access control is a fundamental component of security compliance programs that ensures security technology and access control policies are in place to protect confidential information, such as customer data

Full role-based access control is in place with restrictive password policies, including automated screen lock

Some RBAC (role-based access control) is in place and password policies are strong and enforced, including automated screen lock

No RBAC, but strong password policies are in place, including automated screen lock

Password policy is weak in one or more areas

No RBAC, weak password policy

Does your organisation have an effective access control regime?(Required)

Privileged account management is an ongoing challenge but is critical to get right as unchecked privileged users can present a serious threat

Toolset based privileged account management is in place that enforces separation of duties and granular access rights

Some separation of duties is enforced using normal access control mechanisms (separate user and admin accounts) and privileged access is routinely monitored

Privileged accounts are known and used by IT/IS administration and support teams. Access is audited and periodically monitored

Privileged accounts are known and used by IT/IS administration and support teams. Privileged account usage is not audited or monitored

Widespread admin access is available (includes local admin on endpoints) throughout the organisation

Is Multi-Factor Authentication (MFA) in place?(Required)

MFA should be in place for admin access and for remote connections

Token based MFA is in place for all admin access and for remote connections

Token based MFA is in place for remote connections only

"Weak" MFA (e.g. source IP, dual login) is in place for all admin access and remote connections

Weak MFA (e.g. source IP, dual login) is in place for all remote connections only

No MFA is in place

STEP THREE

Transformation and Maturity

Staying on top of cyber security requires continual transformation and an ongoing maturing of the service. This step measures the organisation's ability to manage this process and its commitment to the process

Has an overarching review of cyber security taken place in your organisation?(Required)

To provide management with an assessment of an organisation's cyber security policies and procedures and their operating effectiveness

A review has taken place and a programme of work has been completed

A review has taken place and a programme of work is underway

A review has taken place but no actions have been agreed

A review is planned

No review has taken place or been planned

Is senior level ownership of cyber security assigned in your organisation?(Required)

Senior level backing for cyber security improvements and BAU activities is critical to the success of cyber security in the organisation

Executive level ownership is assigned and is well understood and acted upon

Executive level ownership is assigned in name only

Senior management level ownership is assigned

Ownership of cyber security is below senior management level

No ownership assigned

Do you have a method to understand your baseline security score and maturity against the baseline over time?(Required)

Understanding where you are in terms of effective controls and continuous measurement over time provides effective decision making and control

A tool is in operation providing baseline scroring and visibility of maturity over time

Baseline scoring and annual rescoring conducted with partial ability review and compare

Baseline scoring and rescoring conducted with no review

Baseline score conducted but not revisted

No maturity or baseline score exists

Are mature cyber security practices embedded into your IT/IS operations?(Required)

Cyber security practices must form a part of daily operations in order for processes to be successful

Mature processes are in place

Some processes are in place and full coverage is planned

Some processes are in place in some areas of the business

Processes are ad-hoc

No processes formally in place

STEP FOUR

Alerts and Threat Intelligence

Active threat intelligence is an ever more critical part of an organisation's overall cyber security posture

Do you have an alerting/monitoring regime in place across your infrastructure?(Required)

Alerting/monitoring is a first step in discovering what is actually happening across your estate; without such knowledge you may have no idea of what is actually happening on your network

Yes, fully in place across all components

Yes, in place across most components, but with some gaps

In place on some components

In place on a few components where a special need exists

No alerting/monitoring is in place

Do you have an internal or outsourced CSOC (Cyber Security Operations Centre)(Required)

CSOC services provide live threat intelligence on managed assets and give you the ability to respond in a timely fashion

Full CSOC service available 24x365

Full CSOC service available in working hours

Partial CSOC service available 24x365

Partial CSOC service available in working hours

No CSOC service

Do you maintain a vulnerability intelligence and management regime?(Required)

New vulnerabilities are continually being discovered and exploited. Organisations must maintain a programme to stay on top of vulnerabilities affecting their infrastructure

A regime is in place across all components

Critical components and/or components from particular manufacturers are covered, but there are gaps

Only components from a single vendor (e.g. Microsoft) are covered by such a regime

Vulnerability intelligence and patching are ad-hoc

No regime in place

Do you subscribe to a CERT (Computer Emergency Response Service)?(Required)

CERT services are an important resource when incidents occur, not only for the knowledge that resides in such teams but for the available resource to tackle large scale incidents

A contracted CERT service is in place covering all components

A contracted CERT service is in place covering critical components only

An informal agreement exists with a supplier to provide CERT services as needed. This supplier has detailed knowledge of the infrastructure

A list of ad-hoc CERT services is maintained to contact in event of an incident

CERT services have not been considered

Do you subscribe to or manage any threat intelligence services?(Required)

Threat intelligence services can provide organisations with advance warning that they are being targeted

Specific threat intelligence is in place and provides comprehensive coverage

Some threat intelligence is formally in place for critical components

Regular threat intelligence research is undertaken but no formal services are in place

Ad hoc research is undertaken

Threat intelligence is not considered

Do you maintain an incident response plan and process?(Required)

Incident response planning ensures a timely and cogent response to incidents as and when they occur

A mature plan and process are in place, and the plan is tested at least annually

A plan and process are in place, but they have not been tested

A plan is in place, but it is not supported by detailed processes and has not been tested

A policy statement is in place, but no detailed planning

Nothing is in place

Do you undertake regular penetration testing?(Required)

Penetration testing provides the attacker's eye view of your systems' vulnerabilities

Quarterly penetration and application tests are undertaken (and/or on major releases) and results are remediated

Annual penetration and application tests are undertaken (and/or on major releases) and results are remediated

Testing is undertaken, but it does not included application testing

Some testing is undertaken, but it is not comprehensive and results are not remediated

No testing is undertaken

STEP FIVE

Governance and Policy

Governance and policies define how organisations manage and control IT and data

Does your organisation have a Chief Information Security Office (CISO), Information Security Officer (ISO) or Information Security Mananger (ISM)?(Required)

A dedicated role for managing information security is, increasingly, a necessity in most organisations

The organisation has a C-level CISO in place with sufficient resources

An ISO is in place with a dotted or permanent report direct to C-level

An ISM is in place in the IT department only

ISO is in place as a part time role

No ISO is in place

Does your organisation have an Acceptable Usage Policy (AUP) in place?(Required)

An Acceptable Usage Policy is a standard document setting out acceptable usage of the organisation's IT assets

AUP is in place, updated and signed

Relevant AUP is in place and is regularly updated, but not signed

AUP is in place and is disseminated but not regularly updated

Draft or out of date AUP in place

No AUP

Is there an effective Joiners, Movers and Leavers process in place?(Required)

JML (Joiners, Movers and Leavers) is a critical process in any organisation, ensuring that only actively employed staff members have access to systems and only in an appropriate fashion

A JML process is in place and is automatically linked to the HR system and is audited

A robust manual JML process is in place

A manual JML process is in place that is by and large effective

A manual JML process is in place that is largely ineffective

No JML process in place

Is an information risk assessment undertaken?(Required)

Risk assessment is a critical activity in prioritising cyber security controls

Risk assessment is undertaken on an ongoing basis and is acted upon

Risk assessment is undertaken on an annual basis and is acted upon

Risk assessment is undertaken as and when thought necessary, some recommendations are acted upon

Ad hoc risk assessments are undertaken for particular systems

No risk assessment undertaken

Is there a regular information security forum established?(Required)

A regular information security forum is an important tool for gathering different views from across the organisation

A regular (at least quarterly) forum is in place with executive level representation and representation from throughout the organisation

A forum is in place below exec level, but with good representation

No forum is in place, but infosec is a regular exec or senior management agenda item

Ad hoc discussion of infosec only

No formal discussion

Is a robust change management regime in place?(Required)

Robust change management is critical to maintaining controls over time

Robust change management is in place using a dedicated system and Change Advisory Board (CAB)

Change management in place on a manual basis, ad-hoc CAB

Changes are discussed as appropriate but no formal system in place

Major changes informally discussed, but otherwise no change management

No change management

Is third party information risk assessed and managed?(Required)

Given the reliance of most organisations on partners and suppliers to deliver critical services, a robust review of third party information risk is critical

Supplier risk is assessed and suppliers are regularly audited

Supplier risk is assessed and suppliers audited/questioned when on-boarded

Supplier risk is assessed when on-boarding for critical suppliers only

Some informal/ad-hoc assessment of supplier risk

No supplier risk assessment

Is an information security training and awareness programme in place?(Required)

A continual programme of information security training and awareness is critical to supporting correct behaviours

A comprehensive training and awareness programme is in place and is monitored

Training and awareness is in place, but there is no or limited management information

Training and awareness take place on induction and on an ad-hoc basis thereafter

Training and awareness is ad-hoc only

No training and awareness

Is there a cyber security insurance policy in place covering the organisation in the event a cyber breach?(Required)

Cyber insurance policies provide financial support and assistance in the event of a cyber breach

Yes, policy exists, is fully understood in terms of clauses and restrictions

Yes, policy exists, clauses not fully understood by all stakeholders

Policy exists and clauses and restrictions are not understood

Policy exists covering small part of the organisation

No cyber insurance policy exists

STEP SIX

Digital Transformation

Cloud readiness to determine strategy and workloads applicable for cloud hosting and operation

Do you have a cloud strategy?(Required)

A dedicated role for managing information security is, increasingly, a necessity in most organisations

Cloud strategy defined, documented and agreed with key stakeholders. Strategy in execution

Cloud strategy developed and agreed. Not in execution

Cloud strategy scheduled for development

Informal conversations and views discussed

No strategy in place

What workloads are planned for the cloud?(Required)

Workloads are defined as applications that are hosted and run in the cloud

Analysis and feasibility study completed and full list of appropriate workloads identified

Workloads identified and some feasibility analysis completed

Critical workloads identified, no analysis completed

Possibilities identified with no detail or analysis conducted

No workloads identified

Is there an active project using a public cloud platform e.g. Microsoft Azure(Required)

How far along the road of digital transformation is the organisation?

A project has been completed successfully that uses a cloud platform

A project is in progress that is using a cloud platform

A project is scheduled to start this year that will use a cloud platform

A project has been identified that could use a cloud platform

No project(s) identified

Have you migrated a workload to public hyperscale cloud?(Required)

Do you have any business applications that are operating out of any public cloud environments?

Multiple production workloads migrated and operating. Exploring optimisation options

In-production workload migrated and operating. Optimisation being considered

Development and test workloads migrated into cloud

Evaluating a test workload into cloud

No workloads migrated into any cloud environments

Is there an accurate record of server utilisation across the estate?(Required)

Server utilisation is the indicator of computing resources used by the current application(s)

Full analysis completed against all processing systems

Full analysis completed against critical business systems only

Some analysis completed against some business systems

Very basic statistics available from management tools in place

No utlisation analysis completed

Does the organisation train and develop individuals on new cloud technologies and principles?(Required)

Cloud computing configuration and management uses different toolsets and configuration designs. Trained personnel are required to ensure correct design, implementation and operation compared to traditional on-premises solutions

A comprehensive training and development programme is in place and is monitored

Training and development programme in place but not monitored

A project is scheduled to start this year that will use a cloud platform

A project has been identified that could use a cloud platform

No training identified or completed

Hidden

Compliance and Accreditation

Hidden

Technical Compliance

Hidden

Transformation and Maturity

Hidden

Events, Alerts & Threat Intelligence

Hidden

Governance & Policy

Hidden

Digital Transformation

Hidden

Based on your results, you should:

Hidden

Prioritise your cyber security

Hidden

Review your cyber security

Hidden

Optimise your cyber security

Hidden

(Required)

Company No.:	03036806
VAT No.:	135526617
Tel:	0800 012 8060
Tel:	+44(0)20 7858 4000
Email:	info@6dg.co.uk

Cookie	Duration	Description
__cf_bm	30 minutes	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
_cfuvid	session	Cloudflare allows the Cloudflare WAF to distinguish individual users who share the same IP address.
bcookie	1 year	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser ID.
bscookie	1 year	LinkedIn sets this cookie to store performed actions on the website.
lang	session	LinkedIn sets this cookie to remember a user's language setting.
li_gc	5 months 27 days	Linkedin set this cookie for storing visitor's consent regarding using cookies for non-essential purposes.
lidc	1 day	LinkedIn sets the lidc cookie to facilitate data center selection.
UserMatchHistory	1 month	LinkedIn sets this cookie for LinkedIn Ads ID syncing.

Cookie	Duration	Description
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gat_UA-26222241-1	1 minute	A variation of the _gat cookie set by Google Analytics and Google Tag Manager to allow website owners to track visitor behaviour and measure site performance. The pattern element in the name contains the unique identity number of the account or website it relates to.
_gcl_au	3 months	Provided by Google Tag Manager to experiment advertisement efficiency of websites using their services.
_gid	1 day	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.
AnalyticsSyncHistory	1 month	Linkedin set this cookie to store information about the time a sync took place with the lms_analytics cookie.
CONSENT	2 years	YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data.
ln_or	1 day	LinkedIn registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.
lo-uid	2 years	Lucky Orange to provide marketing tracking unique id
lo-visits	2 years	Lucky Orange to provide marketing tracking across pages
vuid	2 years	Vimeo installs this cookie to collect tracking information by setting a unique ID to embed videos to the website.

Cookie	Duration	Description
test_cookie	15 minutes	The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies.
VISITOR_INFO1_LIVE	5 months 27 days	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface.
YSC	session	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.

Cyber security Maturity Calculator

Calculator Part 2

STEP ONE

Compliance and Accreditation

STEP TWO

Technical Compliance

STEP THREE

Transformation and Maturity

STEP FOUR

Alerts and Threat Intelligence

STEP FIVE

Governance and Policy

STEP SIX

Digital Transformation

Consultancy

Managed Services

Strategy & Advisory

Useful Links