DivisionCero

Self-Assessment Questionnaires

Self-assessment questionnaires to measure cybersecurity maturity based on Kudo

Goal

We constantly strive for our questionnaires to be more of a Socratic exercise, which is why we make this clear:

  • It's not a test to pass.
  • Cybersecurity isn't binary, or black and white; it's continuous improvement.
  • Each question needs to be weighed against the company's risk appetite, size, strategy and business moment.

How to Use

The questionnaires are in development and will soon be available for:

  • Any time.
  • If you just want to pass it without the business reality, you're only fooling yourself.
  • Integration with management tools
  • Automatic report generation

Questionnaires

Complete Questionnaire

Complete questionnaire that groups the three scopes.

Methodology

Questionnaire and management scopes

For each question it's important to think about three scenarios, associated with the framework's management scopes; each one has a questionnaire, and at the end there's one that covers everything. Take the one that applies to each scenario or go the complete route.

Question levels

Each questionnaire uses a maturity scale:

  • Level 0: The requirement doesn't exist or hasn't been considered.
  • Level 1: It exists reactively or informally.
  • Level 2: It's documented and applied consistently.
  • Level 3: It's standardized across the organization.
  • Level 4: It's measured through metrics and indicators and managed with evidence.
  • Level 5: It's continuously optimized through analysis, automation and feedback.

Calculating the maturity level

The reference represents the cybersecurity maturity level obtained both for each assessed requirement and for the complete questionnaire.

Scale per question

Each question is scored on a scale from 0 to 5, where each point represents a 20% increment of the maximum maturity level.

ScoreComplianceMaturity level
5100%Optimized. The requirement is continuously improved through metrics, automation and feedback.
480%Managed. The requirement is measured through indicators and there's evidence of its management.
360%Standardized. The requirement is defined and applied uniformly across the organization.
240%Documented. The requirement is documented and applied consistently.
120%Initial. The requirement exists reactively or informally.
00%Not implemented. The requirement doesn't exist or hasn't been considered.

Interpreting the questionnaire

The questionnaire's maturity level is calculated with the following formula:

M=∑i=1npi5n×100M=\frac{\sum_{i=1}^{n}p_i}{5n}\times100

Where:

  • ∑pi\sum p_i is the sum of the points obtained across all questions.
  • 5n5n is the maximum possible points, 55 being the maximum score per question and nn the total number of questions.

Example

For a questionnaire with 20 questions:

  • Maximum possible points: 5×20=1005 \times 20 = 100
  • Points obtained: 8383

Then:

M=83100×100=83%M=\frac{83}{100}\times100=83\%

The result indicates that the questionnaire reaches 83% maturity, equivalent to a Managed level, since most requirements have metrics, evidence and tracking mechanisms, although there are still opportunities for continuous optimization.

Questionnaire maturity ranges

Once the compliance percentage has been calculated with the maturity level formula, the result is interpreted according to the following ranges:

ComplianceMaturity levelDescription
100%Level 5 – Cybersecurity Co-creationCybersecurity is part of the business strategy and decision-making. There's continuous improvement, automation, metrics and a culture of collaboration across areas. The risk appetite is clearly defined and continuously monitored, and business decisions consider the impact on cyber risk as a strategic factor.
80% – 99%Level 4 – StrategicCybersecurity is managed as a business enabler. Controls are measured and there's evidence of their effectiveness. The risk appetite is used to prioritize investments, define exceptions and support strategic decisions in an informed way.
60% – 79%Level 3 – TacticalCybersecurity processes are defined, documented and standardized. Risk management is consistent and tactical decisions consider the risk appetite, although its application isn't yet uniform across the organization.
40% – 59%Level 2 – OperationalThere are documented processes and controls that run consistently, although with opportunities for strengthening. The risk appetite is starting to be used as a reference for operations, but decisions are still mostly reactive.
20% – 39%Level 1 – BasicThe organization has initial cybersecurity practices implemented reactively or informally. The risk appetite isn't formalized or is little known, so business decisions are usually made with limited information about cyber risk.
0% – 19%Level 0 – CriticalThe organization has a critical maturity level. Cybersecurity processes and controls are nonexistent or insufficient to manage risks properly. There's no defined risk appetite and business decisions are made without a structured consideration of cyber risk exposure.

Questionnaires on the roadmap

On the roadmap

Internal Scope Questionnaire (Corporate)

Questionnaire applicable to the Internal (Corporate) scope.

Third-Party Scope Questionnaire

Questionnaire applicable to the Third-Party scope (Vendors and Partners).

External Scope Questionnaire (Customers)

Questionnaire applicable to the External scope (Customers).

Complete Questionnaire

Complete Questionnaire (groups the Internal, Third-Party and External scopes)

On this page

GoalHow to UseQuestionnairesMethodologyQuestionnaire and management scopesQuestion levelsCalculating the maturity levelScale per questionInterpreting the questionnaireExampleQuestionnaire maturity rangesQuestionnaires on the roadmap