Q1 — Risk Governance

Does your organization have a documented enterprise risk framework approved by the board?

Q2 — Risk Appetite

Have you defined and communicated risk appetite statements for your key risks?

Q3 — KRI / KPI Reporting

Are key risk indicators tracked and reviewed regularly by leadership?

Q4 — Risk Culture & Ownership

Are risk owners identified for each material risk, with named accountability?

Q5 — Cyber Maturity

Are you aligned to NIST CSF (or equivalent) with a documented maturity assessment?

Q6 — Third-Party Risk

Do you have a TPRM program with ongoing vendor monitoring (not just onboarding)?

Q7 — Compliance Mapping

Are your regulatory requirements mapped to specific controls with evidence?

Q8 — Incident Response

Have you tested your incident-response plan (tabletop or live) in the last 12 months?

Q9 — Audit Findings

Are open audit / regulatory findings tracked with target dates and owners?

Q10 — Continuous Improvement

Does your risk program have a defined annual refresh cycle and feedback loop?

Where should we send your detailed report?

We'll email a personalized 1-page breakdown of your score, the gaps it implies, and three specific next moves. No spam, no sales sequence — just the report.

Takes 2 seconds. We respond within 1 business day.