FOR BUSINESS OWNERS AND SECURITY PROGRAMME LEADS
The decision this helps prepare
Which security outcomes need an owner, clearer evidence or a better recovery plan?
What the review covers
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
Useful information to have nearby
- A current service inventory with owners
- A recent risk review and assigned actions
- A backup restoration or incident exercise record
Use references and non-sensitive summaries. Do not paste account credentials, private client records or raw vulnerability evidence.
Example questions
- Does security have a named decision-maker?
- Do you understand where sensitive information flows?
- Are baseline configurations and updates maintained?
- Can the team find an incident contact and decision process?
- Are recovery priorities agreed with service owners?
After the review
Use a current-to-target roadmap to turn the gaps into an agreed sequence of work.
Review unknown answers, save a local snapshot, export a report or make a current-to-target plan. You can use the result without sending a message.
Scope and reference
18 original prompts across the six CSF functions. Selected screening topics, not the complete CSF Core or an official NIST score.
Questions are original. The reference provides context and does not endorse this website.
Read the reference