Free self-assessment · 35 minutes
Forty-eight controls, and whether you do them consistently
Most gaps are not things nobody thought of. They are things that are done on some machines, by some people, in some months. This walks forty-eight security controls and asks, for each one, whether it happens consistently — which is a harder and more useful question than whether it happens at all.
Who it is for
An organisation that has outgrown a quick check: one with IT staff, a server or two of its own, and a reason to know control by control where it stands. It is also the right starting point if a customer or an insurer has begun asking for evidence rather than assurances.
What it covers — eight areas, forty-eight controls
- Access and identity (11)
- Configuration and maintenance (8)
- Detection and response (9)
- Network protection (6)
- Backup and recovery (4)
- Physical and media (4)
- People and awareness (3)
- Risk and assurance (3)
Most of the controls are drawn from the set the US federal government uses to protect sensitive information held by its suppliers. That lineage matters for a practical reason: it is the vocabulary your larger customers’ questionnaires are written in, so the answers you produce here tend to be reusable.
What you get
The same report structure as the quick check, with considerably more in it: a score per area, and findings at control level rather than theme level — typically twenty of them, ranked by severity. Thirty-five minutes of answering buys a document you can hand to an engineer and a document you can hand to a board, in one.
What the report looks like
Three pages from a real report, generated by running the assessment.
How you scored 
What to address 
Your answers
Set aside the time
It is not a form to fill in between meetings, and the estimate is honest. Pull the person who administers the systems into the room for it — the half-answers come from guessing at someone else’s area.
The assessment starts below — you do not need to go anywhere else.
A few details first
We use these to prepare your report and, if you would like, to talk it through afterwards.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Finish it in one sitting. Scoring happens on submission, so a half-finished run produces nothing at all. Thirty-five minutes is the honest estimate for someone who knows the systems; block the time rather than starting it between meetings.
Whoever actually administers the systems, together with someone who can speak for policy. Alone, each guesses at the other's half — and the guesses are optimistic in a consistent direction, which is exactly the bias this is meant to remove.
An audit verifies. This asks. Nobody inspects your evidence here, which is precisely why it is free and takes thirty-five minutes rather than several days. What it gives you is the map an auditor would start from, produced before anyone is billing by the day.
Usually, and that is a deliberate design choice. Most of the controls come from the set the US federal government uses for sensitive information held by suppliers, which is the vocabulary large customers' security questionnaires are written in. The wording will differ; the substance tends to map directly.
Often yes, and twenty minutes settle it. A certificate says a management system exists and was working at audit time. This asks whether forty-eight specific technical controls are applied consistently right now — and the gap between those two things is where most of the year happens.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.