1. Do you have an inventory of devices and software?

Yes No / Not sure

Identify function — if you don't know what you have, you can't protect it.

2. Is there a documented information-security policy?

Yes No / Not sure

Identify function — the governing document.

3. Is MFA enforced on all accounts?

Yes No / Not sure

Protect function — the single highest-impact control.

4. Are all endpoints running EDR?

Yes No / Not sure

Protect function — modern equivalent of antivirus.

5. Are backups automated and tested?

Yes No / Not sure

Recover function — only real measure of resilience.

6. Is logging centralized for auth + admin actions?

Yes No / Not sure

Detect function — no logs, no detection.

7. Do you run tabletop exercises for incidents at least yearly?

Yes No / Not sure

Respond function — rehearse before the real thing.

8. Are security awareness trainings completed yearly?

Yes No / Not sure

Human layer — often the weakest.

9. Is access reviewed and offboarded within 24h of departure?

Yes No / Not sure

Protect function — dormant accounts are the top attacker pivot.

10. Are privileged accounts separated from daily use?

Yes No / Not sure

Protect function — blast radius reduction.

11. Is patch management automated for OS + core apps?

Yes No / Not sure

Protect function — 90% of exploits target known CVEs.

12. Do you have a written incident response plan?

Yes No / Not sure

Respond function — don't improvise during a breach.

Security Maturity Score