🧑‍💼
🏢
🏢
🚨
🎯
🔐 👤 💻 🌐 📧
🚀

Build Your Security Program

Assess each domain to create a comprehensive security maturity roadmap aligned with NIST CSF 2.0

Security Program Maturity
0 of 13 domains assessed
0%
Tier 1: Foundation 0/5
Tier 2: Detection 0/3
Tier 3: Governance 0/2
Tier 4: Advanced 0/3
Tier 1

Foundation - Implement First

Core security controls that form the foundation of your security program

No login required
🔐
Identity & Access Management
Authentication, authorization, privileged access, and identity lifecycle management
Not assessed
No login required
💻
Endpoint Security
EDR/XDR, antivirus, patch management, device hardening, and mobile device security
Not assessed
No login required
🌐
Network Security
Firewalls, segmentation, IDS/IPS, DNS security, and DDoS protection
Not assessed
No login required
💾
Data Security & Encryption
Data classification, encryption at rest/transit, DLP, and data lifecycle management
Not assessed
Tier 2

Detection & Response

Advanced monitoring and response capabilities to identify and contain threats

🎯
Security Monitoring & Detection
SIEM, SOC operations, threat intelligence, log management, and anomaly detection
Not assessed
🔍
Vulnerability Management
Vulnerability scanning, patch management, penetration testing, and attack surface management
Not assessed
🚨
Incident Response & Recovery
IR plans, playbooks, forensics, backup/DR, and business continuity
Not assessed
Tier 3

Governance & Culture

Strategic oversight and human-focused security controls

📋
Governance, Risk & Compliance
Security policies, risk assessments, compliance frameworks (SOC 2, ISO 27001, PCI-DSS), and audit readiness
Not assessed
🎓
Security Awareness & Training
Phishing simulations, security training programs, and security culture metrics
Not assessed
Tier 4

Advanced & Specialized

Specialized capabilities for modern infrastructure and supply chain

☁️
Cloud Security
CSPM, CWPP, cloud IAM, container security, serverless security, and multi-cloud governance
Not assessed
⚙️
Application Security
Secure SDLC, SAST/DAST, code review, API security, and WAF
Not assessed
🤝
Third-Party Risk Management
Vendor security assessments, SLA management, supply chain security, and fourth-party risk
Not assessed

📋 Capability View Tutorial

What This View Shows

The Capability View organizes your security roadmap into three strategic phases based on your assessment results:

  • Now (0-3 months): Critical priorities that address your largest gaps and highest risks
  • Next (3-9 months): Important capabilities that build on foundational work
  • Later (9-18 months): Advanced capabilities for long-term maturity

How to Read Each Card

  • Title: The security capability to implement
  • Description: What you'll build and why it matters
  • NIST Tags: Framework mappings to NIST CSF 2.0
  • Gap: How many maturity levels you need to advance
  • Duration: Estimated implementation time
  • Dependencies: Prerequisites that must be completed first

How Priorities Are Calculated

Capabilities are prioritized based on:

  1. Gap size (larger gaps = higher priority)
  2. Current maturity level (lower levels = higher risk)
  3. Dependencies (foundation before advanced features)

📅 Timeline View Tutorial

What This View Shows

The Timeline View provides a calendar-based roadmap showing when each capability will be implemented across the year.

How to Read the Timeline

  • Timeline Bars: Each colored bar represents one capability implementation
  • Bar Position: Shows which quarter(s) the work will occur
  • Bar Width: Indicates duration of implementation
  • Bar Color:
    • Blue (Now) = Immediate priorities
    • Purple (Next) = Near-term goals
    • Gray (Later) = Long-term vision
  • Duration Label: Estimated weeks to complete

Understanding the Schedule

Capabilities are sequenced to:

  1. Tackle critical risks first
  2. Build foundations before advanced features
  3. Respect dependencies (e.g., MFA before PAM)
  4. Distribute workload across quarters

📌 Note: Timelines are estimates based on typical mid-market implementations. Adjust based on your team's capacity and vendor selection.

📊 Gap Analysis Tutorial

What This View Shows

The Gap Analysis provides a detailed comparison of your current security maturity versus recommended target levels for each capability.

Understanding the Table

  • Capability: The security practice being evaluated
  • Current: Your maturity level from the assessment (0-4)
    • 0 = None/Ad-hoc
    • 1 = Initial/Basic
    • 2 = Managed/Developing
    • 3 = Defined/Mature
    • 4 = Optimized/Advanced
  • Target: Recommended level based on your organization's risk profile
  • Gap: Difference between target and current (Target - Current)
  • Priority:
    • Critical = Gap ≥3 or (Gap ≥2 and Current ≤1)
    • High = Gap ≥2 or (Gap ≥1 and Current =0)
    • Medium = Gap ≥1
    • Low = Gap <1
  • Impact: Business and security consequences of the gap

How to Use This View

  1. Focus on Critical and High priority gaps first
  2. Review the Impact column to understand business risks
  3. Use this data to justify security investments to leadership
  4. Track progress by retaking the assessment quarterly

Summary Statistics

The cards at the bottom show:

  • Total Gaps: How many capabilities need improvement
  • Critical Priority Items: Urgent risks requiring immediate attention
1
Welcome!
Let's take a quick tour...
Step 1 of 8