Rate where you honestly stand on each IT Top 10 practice. This is a directional self-check, not an assessment — nothing is sent unless you choose to email it.
IT-01 Phishing-Resistant Multi-Factor Authentication (MFA)Choose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-02 Comprehensive Asset Inventory ManagementChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-03 Strategic Technical Debt ReductionChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-04 Flexible Technology StackChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-05 Logical Segmentation to Limit Adversary Lateral MovementChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-06 Risk-Based Vulnerability ManagementChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-07 Integrate Security Early in the Development LifecycleChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-08 Secure AI Adoption and Data ProtectionChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-09 Resilient Backup and Disaster Recovery ArchitectureChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
IT-10 Continuous Technical Workforce ReadinessChoose a level… 0 · Absent — The capability does not exist in any form. 1 · Documented — Intent exists on paper. Deployment has not happened or is incomplete. 2 · Configured — The technology or process is configured, but not yet applied to the intended scope. 3 · Deployed — It is applied across the scope it was meant to cover. 4 · Operating — It functions consistently during normal operations, not only when someone is watching. 5 · Measured — Coverage and effectiveness are measured, monitored, and exception-handled. 6 · Governed — Ownership, scheduled review, continuous improvement, and evidence retention are established.
