Section A – Organization Profile

Please provide basic information about your organization. This helps us size risk and tailor recommendations.

Legal or primary operating name of your organization.
Select the best fit for your organization.
This helps us size organizational risk and scale.
Approximate number of full-time and part-time employees.
Work Model
Check all that apply.
Approximate number of physical offices or operational sites.
Internal, outsourced, or hybrid.
Regulatory or Compliance Requirements
Select any regulatory or compliance requirements that apply.

Section B – Technology Environment

These questions help us understand your core platforms, systems, and data footprint.

Primary Technology Environment
Check all operating environments that apply.
Identity & Access Provider(s)
Select all identity providers that you use.
Critical Business Systems & Applications
Check all systems that are critical to day-to-day operations.
Sensitive Data Types Handled
Select all types of sensitive data your organization handles.

Section C – Business Risks and Context

Help us understand your top cybersecurity concerns and any past incidents.

Describe your top cybersecurity concerns (e.g., ransomware, phishing, vendor risk, compliance, remote work).
Describe what happened, approximate dates, impact, and how it was resolved (if known).

Section D – NIST: Govern (GV)

Questions about cybersecurity governance, policies, leadership, and accountability.

Indicate whether your security policies are formally written and approved.
Helps determine the currency and maturity of your policies.
Identifies who owns cybersecurity responsibilities.
Measures how clearly cybersecurity responsibilities are defined across the organization.
Helps assess security culture and human risk management.
Indicates how cybersecurity investments are planned and funded.
Use this space to provide any additional details about your cybersecurity governance structure, policy challenges, leadership involvement, or decision-making processes. Examples: outdated policies, unclear ownership, lack of executive support, competing priorities, or any governance constraints.

Section E – NIST: Identify (ID)

Identify focuses on understanding assets, data, systems, and risk across the organization.

Determines whether the organization tracks hardware and software assets.
Examples: Intune, Jamf, RMM, CMDB, spreadsheets, manual processes.
Indicates maturity of data handling and protection practices.
Helps determine organizational risk assessment maturity.
Assesses awareness and management of third-party and supply-chain risks.
Indicates how well your business environment and dependencies are understood.
Add any relevant details about your assets, data, business functions, or risk identification processes. Examples: gaps in asset tracking, undocumented systems, data flow concerns, reliance on specific vendors, or unique business operations that impact risk.

Section F – NIST: Protect (PR)

Protect focuses on safeguarding systems and data through security controls and practices.

Indicate whether MFA is enforced across your organization. MFA greatly reduces the risk of unauthorized access.
Endpoint protection tools such as antivirus or EDR help prevent and detect threats on workstations and servers.
Device management tools enforce security settings and help track devices.
Addresses access control and privilege management for users and administrators.
Measures how consistently systems are updated to fix known vulnerabilities.
Indicate whether critical systems and data are backed up on a consistent schedule.
Segmentation separates systems to limit the spread and impact of threats.
Which email security controls do you use? (if known)
Select any controls that help protect users from phishing, malware, and email-based threats.
Use this area to describe any additional details about your security controls, exceptions, or unique circumstances. Examples: systems excluded from MFA, devices not under management, legacy apps that can’t be patched, backup challenges, or compensating controls used to mitigate risks.

Section G – NIST: Detect (DE)

Detect focuses on monitoring, logging, and identifying potential cybersecurity events quickly.

Indicate whether important systems generate and store logs that can be used to detect threats.
Monitoring tools and services detect suspicious activity and alert you to potential incidents.
Indicate whether you receive alerts when unusual or risky activity occurs.
Regular access log reviews help identify unauthorized activity or misuse.
Provide details about your monitoring, logging, and alerting processes that weren’t covered above. Examples: log sources missing coverage, alert fatigue, manual log review challenges, gaps in SIEM/MDR visibility, or issues with correlation, tuning, or false positives.

Section H – NIST: Respond (RS)

Respond focuses on how your organization prepares for, manages, and communicates during cybersecurity incidents.

Determines whether a formal process exists for handling cyber incidents.
Helps determine if the plan is current and actionable.
Identifies who coordinates and leads response activities.
Tabletop exercises help validate readiness and uncover weaknesses in response plans.
A communications plan ensures appropriate messaging to employees, clients, regulators, and other stakeholders during incidents.
Add any additional context about your incident response readiness. Examples: escalation challenges, unclear roles, gaps discovered during incidents, communications issues, outdated runbooks, or concerns around coordination between internal teams and external partners.

Section I – NIST: Recover (RC)

Recover focuses on restoring operations and continuity after cybersecurity incidents or outages.

A documented Disaster Recovery Plan outlines how your organization restores systems and operations after an outage or incident.
Testing validates whether backups and recovery processes work as expected and how long restoration takes.
Indicate your confidence level in restoring critical systems following a major incident.
Cyber insurance may help cover incident response, forensics, recovery costs, and legal liabilities.
RTO/RPO are key metrics that define how quickly systems must be restored and how much data loss is acceptable.
Use this space to share any additional information about your disaster recovery or business continuity efforts. Examples: long restore times, difficulty validating backups, dependency issues, DR documentation gaps, untested recovery procedures, or concerns about restoring legacy systems.

Section J – Business Impact and Next Steps

These final questions help us understand operational impact, upcoming changes, and areas where you are most interested in strengthening your security posture.

Describe the operational, financial, and customer impact of downtime (e.g., revenue loss, halted production, compliance issues).
Examples: cloud migrations, new applications, office moves, mergers/acquisitions, major hiring, or process changes.
Examples: vulnerability assessments, SOC/MDR, cloud security, policy development, backup modernization, or security awareness training.
Use this space to provide any context, concerns, or details that were not captured in the previous sections. This may include upcoming business initiatives, known security challenges, vendor changes, organizational shifts, unresolved issues, or anything else you believe is important for Ntreks to consider in your cybersecurity assessment.