Cybersecurity Governance Training & Evidence Systems

Readiness Self-Assessment

RSA – Readiness Self-Assessment
First
Last

Title/Roles Section

Qualification

Primary environment
Sensitive data types

The Self-Assessment Questions

Domain 1: Governance Structure

1. We have clear executive ownership for cybersecurity risk.
2. We have defined escalation thresholds for when cyber issues reach leadership/board.

Domain 2: Risk Recognition

3. We maintain a cyber risk register or equivalent documented list of major risks.
4. The board/executives receive a cybersecurity risk briefing on a regular cadence.

Domain 3: Control Decisions

5. We have board/executive-approved security policies (not just IT procedures).
6. We have adopted a recognized security framework (even informally).

Domain 4: Oversight & Accountability

7. We obtain independent assurance or audits of security controls and track remediation.
8. We can show documented follow-through on identified cyber risks.

Domain 5: Evidence Preservation

9. We can produce governance evidence (policies, minutes, risk decisions) within 48 hours.
10. We retain incident records, assessments, and security documentation in a controlled repository.
Ready to build defensible oversight? Request Executive Briefing