Assess Your Cyber Maturity | Eye Security Cyber Maturity Tool

ID.AM – Asset Management(Required)

Are you aware of all the systems, websites, and domain names you use?

No. We don’t have an inventory.

Yes. Some assets documented (e.g., through pentests).

Yes. We have a comprehensive inventory of all assets, including systems and websites.

ID.GV – Governance(Required)

Do you have established procedures and policy documents for risk management?

Little to no procedures and policies in place.

Yes. Policies exist, but they mainly address critical security issues.

Yes. We have comprehensive policy frameworks, such as ISO27K1, effectively implemented for risk management.

ID.RA – Risk Assessment(Required)

Have you identified and taken additional measures to safeguard your company’s ‘crown jewels’ (systems and data), both internally and externally?

There are little to no identification or protection measures in place.

Crown jewels are identified.

Yes, security measures are in effect to protect the ‘crown jewels’, addressing both internal and external threats.

DE.AE – Anomalies and Events(Required)

Is your network equipped to promptly detect and respond to malicious activities?

Not equipped.

Basic antivirus in place.

Advanced endpoint detection and response (EDR) systems deployed.

DE.CM – Security Continuous Monitoring(Required)

How are security alerts from different systems handled?

Infrequently or not at all.

Managed by the IT department.

Managed by the Security Operations Centre (SOC) monitoring team.

RS.RP – Response Planning(Required)

In case of a cybersecurity incident outside regular office hours, do you have confidence that it will be handled appropriately?

Hardly or not at all.

An incident response plan is in place.

An incident response plan is in place, and annual tests are conducted.

RS.IM – Improvements(Required)

Do you have a clear understanding of past incidents and the actions taken to prevent their recurrence?

I lack a current overview of past incidents.

I occasionally hear about incidents.

We frequently experience incidents, and I or our designated personnel are well-informed about most of them.

RS.AN – Analysis(Required)

Do the individuals responsible for evaluating security alerts have the necessary knowledge and experience to do so effectively?

The current level of expertise is limited.

Alerts are reviewed, but automatic resolutions are common without further investigation.

Our specialists typically conduct thorough investigations when handling alerts.

RE.RP – Recovery Planning(Required)

How confident are you that your business would recover quickly in the event of an incident right now?

I have little to no confidence.

In principle, we would be able to recover.

We regularly practice incidents, and our recovery time is known.

First Name*(Required)

Last Name*(Required)

Email Address*(Required)

Company Name(Required)

Job Title*(Required)

Number of Employees(Required)