Readiness Self-Assessment

1. We have clear executive ownership for cybersecurity risk.

2. We have defined escalation thresholds for when cyber issues reach leadership/board.

3. We maintain a cyber risk register or equivalent documented list of major risks.

4. The board/executives receive a cybersecurity risk briefing on a regular cadence.

6. We have adopted a recognized security framework (even informally).

7. We obtain independent assurance or audits of security controls and track remediation.

8. We can show documented follow-through on identified cyber risks.

9. We can produce governance evidence (policies, minutes, risk decisions) within 48 hours.

10. We retain incident records, assessments, and security documentation in a controlled repository.