 ________  ___      ___      ___  _______                       _____      ________      
|\  _____\|\  \    |\  \    /  /||\  ___ \                     / __  \    |\   __  \    
\ \  \__/ \ \  \   \ \  \  /  / /\ \   __/|     ____________  |\/_|\  \   \ \  \|\  \   
 \ \   __\ \ \  \   \ \  \/  / /  \ \  \_|/__  |\____________\\|/ \ \  \   \ \  \\\  \  
  \ \  \_|  \ \  \   \ \    / /    \ \  \_|\ \ \|____________|     \ \  \   \ \  \\\  \ 
   \ \__\    \ \__\   \ \__/ /      \ \_______\                     \ \__\   \ \_______\
    \|__|     \|__|    \|__|/        \|_______|                      \|__|    \|_______|

Risk Assessment

Complete this assessment to evaluate your security posture

Back to Home

Basic Information

Company Name

Technical Risk Assessment

Identity & Access Management (IAM)

Q1. How are user identities managed?

Q2. Are privileged accounts managed through dedicated controls?

Q3. Is MFA enforced across users and admins?

Q4. Are guest/external users managed securely?

Q5. How is user offboarding handled?

Cloud & SaaS Security

Q6. What cloud platforms are used?

Q7. Is cloud misconfiguration continuously monitored?

Q8. Are SaaS applications inventoried and monitored?

Q9. Are third-party cloud integrations reviewed?

Q10. How is cloud access governed?

Network & Endpoint Security

Q11. What network segmentation model is used?

Q12. What type of endpoint protection is used?

Q13. Are unmanaged devices allowed on the network?

Q14. How are VPN and remote access controlled?

Q15. Is network traffic monitored for threats?

Data Protection & Privacy

Q16. How is sensitive data identified and classified?

Q17. Is data encrypted at rest and in transit?

Q18. How are backups managed?

Q19. Is shadow IT or unsanctioned data use addressed?

Q20. Is there a data retention and disposal policy?

Operations & Monitoring

Q21. Is there centralized logging/SIEM in place?

Q22. How are security alerts triaged and responded to?

Q23. Are privileged actions audited and reviewed?

Q24. Are vulnerabilities scanned and patched?

Q25. Are security tools regularly tested?

Governance, Risk & Compliance

Q26. Is there a risk register maintained?

Q27. Are third-party/vendor risks tracked?

Q28. What is the status of the incident response plan (IRP)?

Q29. Is there executive or board-level security reporting?

Q30. Are users trained on security awareness?

Platform & OS Posture

Q31. What is the general state of endpoint operating systems in use?

Q32. What is the state of server operating systems in the environment?

Q33. What is the Active Directory forest functional level?