Cybersecurity Posture Scorecard

18 questions · Five categories

Cybersecurity posture scorecard

Review the controls you can confirm today. Choose “Not sure” when you need evidence, and we’ll flag that uncertainty separately.

Explore all security assessments →

Self-reported coverageA practical starting point

Self-reported coverage, not breach probability, a compliance assessment, or NIST certification. All applicable controls have equal weight. Full coverage earns 2 points, partial coverage 1, and reported gaps 0. Unverified answers widen the possible range; they are not treated as reported gaps. Not applicable is excluded without earning points.

01 Ownership and visibility

Is a named person accountable for cybersecurity decisions and coordinating providers?
This can be an internal leader. The person should have authority, clear responsibilities, and a way to coordinate the people doing the work.
Do you maintain a current inventory of devices, software, and cloud services?
Include business-owned and authorized personal devices, important applications, and cloud accounts. An old spreadsheet with missing systems is partial coverage.
Are your outside IT providers’ security responsibilities clearly agreed?
Check who handles updates, account access, alert review, incident response, and backups. Choose not applicable only if no outside IT providers are used.

02 Accounts and access

Is multi-factor authentication enforced for email, administrator accounts, and remote access?
Coverage should include all three where used, with exceptions documented and controlled. Covering only some users or systems is partial.
Do you review access and promptly remove it when staff leave?
Include employees, contractors, shared accounts, cloud services, and privileged access. Reviews and a reliable leaving process both matter.
Is sensitive business data encrypted on devices and in transit?
Check laptops, mobile devices, removable media, and network transfers. Confirm key management and coverage rather than assuming encryption is enabled.

03 Everyday protection

Are security updates installed promptly, especially for serious vulnerabilities?
Use risk-based deadlines, track exceptions, and confirm installation. Include internet-facing systems, devices, applications, and managed services.
Is maintained malware protection active on relevant endpoints?
Check supported devices, current protection, health monitoring, and response to disabled agents or detections.
Is appropriate protection applied across offices and remote work?
Consider secure connections, managed devices, network access, and consistent policies wherever people work. A single office still needs suitable protection.
Do you filter malicious email and unsafe websites?
Consider phishing, malicious attachments, links, and website access for office and remote users. Having only one layer is partial coverage.
Do staff receive regular guidance and practice recognizing and reporting suspicious activity?
Include new starters, periodic refreshers, realistic practice, and a clear reporting channel without blame.

04 Monitoring and improvement

Are important security alerts reviewed and escalated, including after hours?
Confirm who acts, how quickly, and who can authorize containment. Merely collecting alerts is not the same as reviewing them.
Are usable security logs retained for investigation and your organization’s requirements?
Check relevant systems, timestamps, access protection, searchability, and a retention period justified by your needs. There is no universal duration in this scorecard.
Do you check regularly for weaknesses and track fixes to completion?
Include vulnerability checks and configuration reviews, with owners, deadlines, and confirmation that fixes worked.

05 Response and recovery

Can you quickly isolate a compromised device?
Confirm that someone has the tools and authority to disconnect or contain a device, including outside office hours.
Do you have an incident-response plan that you practice?
The plan should cover decisions, containment, communications, outside support, and recovery. A document that has never been exercised is partial coverage.
Are backups protected from attacker modification or deletion?
Consider immutable or offline copies, separate access controls, and protection from compromised administrator credentials. Unverified settings need checking.
Have you successfully tested recovery from backup?
A completed backup job is not a recovery test. Restore important data or systems and confirm they are usable within business recovery needs.

Receive your scorecardEmail address (required for this scorecard)

When you submit, your email and answers are sent to Network Box USA to calculate and email your scorecard. You and NBUSA both receive your full scorecard, including your email, answers, and findings. This does not subscribe you to marketing.

We do not create a public report or save your answers in an assessment database. Temporary delivery fingerprints, counters, and status flags expire after 24 hours. Email copies remain in the recipient mailboxes under our privacy policy. Until submission, your answers remain on this page.

This form uses the site’s reCAPTCHA security check.

Only this main scorecard needs an email. The other assessments remain open.

Scorecard FAQ

How to interpret your Cyber Security Score.

What does the Cyber Security Score assess?

The scorecard reviews ownership, coverage, monitoring, response, and other practical security-program questions to help identify uncertainty and potential gaps.

Is the score a certification or compliance assessment?

No. It is a directional self-assessment for discussion and prioritization. It does not certify security, prove compliance, or replace a technical assessment by qualified professionals.

How are partial and unknown answers scored?

Full coverage earns two points and partial coverage one. Reported gaps earn zero. Not sure is unverified and widens the coverage range rather than being labeled a missing control. A genuinely not-applicable provider question is excluded without earning points.

Why does this scorecard ask for an email?

Your email and answers are submitted to calculate and email your results. Network Box USA receives your email and assessment summary too. There is no public report archive or marketing subscription. Temporary delivery records expire after 24 hours; email copies are retained under our privacy policy.

Can the score prove that an organization is secure?

No. Security posture depends on the real configuration and operation of systems, users, vendors, processes, and controls. The score is a starting point for a deeper review.

What should we do with the results?

Use the lower-scoring areas to prioritize validation, assign ownership, gather evidence, and decide which risks require technical, procedural, or governance changes.

Can Network Box USA review the result with us?

Yes. A security stack review can translate the answers into a discussion about current controls, coverage gaps, overlapping tools, responsibilities, and an appropriate managed-service scope.

Review the gaps

Turn your answers into a practical coverage plan.

Review My Score

Build coverage around the job security needs to do.

Protection shaped around real-world pressure.

Expand the security practice without building every function.

Turn security complexity into clearer decisions.

Managed security built around accountable ownership.

Turn a vague concern into a clearer conversation.