Take The 2022 Security Operations Trends Survey Today  START 
Arctic Wolf
Arctic Wolf

Security Assessment

The Security Operations
Maturity Assessment

Security is a journey, not a destination.
Take this assessment to find out if your organization is on the right path.

Many obstacles appear along the security journey, and security professionals must determine the best way to overcome them.
When starting your security journey, a key approach our Concierge Security® Team recommends is to adopt a common framework such as the NIST Cybersecurity Framework to benchmark your security programs against. NIST spans five functions (Identify, Protect, Detect, Respond, Recover), and offers guidelines and best practices for organizations to better manage and reduce cyber risk.
Interested in seeing how your organization is positioned for today’s threat landscape? Take our 5-minute Security Operations Maturity Assessment and find out where you’re currently at on your security journey, while also gaining ideas on how to improve your overall security posture.
Assess your security maturity
NIST Framework Category: Identify
The identify function provides business context, the resources supporting critical functions, and the related cybersecurity risks that enable an organization to focus and prioritize efforts consistent with its risk management strategy.
Do you have access to cybersecurity professionals who can help improve security at your organization? *

Strategic security guidance drives continuous improvement that is tailored to your desired business outcomes.

Seek partners with security expertise and a unique knowledge of your environment to improve your overall posture along your security journey.

Do you know if your security posture is getting stronger over time? *

Ending cyber risk means reducing the likelihood and impact of a threat. Your security strategy should be measured, reviewed, and adjusted to ensure your security posture is getting stronger throughout the course of your security journey.

Where do you have visibility into misconfigurations? (select all that apply) *

If you can’t see it, you can’t protect it. That’s why having broad visibility across your entire attack surface is critical.

Ensure that you are collecting telemetry from your servers, workstations, networks, and cloud environments – and that your data is accessible through a cloud native platform for easy recall and analysis.

NIST Framework Category: Identify
The identify function provides business context, the resources supporting critical functions, and the related cybersecurity risks that enable an organization to focus and prioritize efforts consistent with its risk management strategy.
Are you able to meet all your security compliance obligations? *

HIPAA, FFIEC, NIST 800-171 – each industry is different with how access to sensitive information is controlled and protected.

Your security solution should deliver to the unique requirements for security and data governance based on your industry and unique business outcomes and assist you in achieving regulatory compliance.

Where do you actively scan for vulnerabilities? (select all that apply) *

Regular vulnerability scanning helps to identify risks more actively. Scans of external networks should take place at least monthly, while vulnerability scanning of your hosts and internal networks should be done on a continuous basis to catch new risks that point-in-time vulnerability assessments miss.

NIST Framework Category: Protect
The protect function informs the implementation of appropriate safeguards to ensure delivery of critical infrastructure services—and informs whether the impact of a threat can be limited or contained.
Does your organization have endpoint protection? *

Workforces have become completely dispersed from the trusted corporate network. Endpoint protection is therefore critical to maintaining visibility into remote workstations and critical assets. Seek partners that provide you with visibility and protection of your endpoints. Your partners should have the expertise to help you make sense of vulnerabilities and indicators of compromise.

Do you have a security awareness training program? *

Security awareness training programs are critical because cyber risk can come from anywhere. These programs provide focused learning on your organization’s greatest risks and close the knowledge gap by equipping employees with the foundational knowledge required to stay vigilant against these threats.

NIST Framework Category: Detect
The detect function defines the appropriate activities to identify the occurrence of a cybersecurity event and enables the timely discovery of cyber threats.
From which environments do you collect telemetry? (select all that apply) *

If you can’t see it, you can’t protect it. That’s why having broad visibility across your entire attack surface is critical.

Ensure that you are collecting telemetry from your servers, workstations, networks, and cloud environments – and that your data is accessible through a cloud native platform for easy recall and analysis.

Do you know if (and where) your company is exposed on the dark web? *

The reuse of corporate credentials has been the #1 attack tactic for the last several years running.

Since password reuse across multiple sites is pervasive, your organization could become exposed as the result of a 3rd party data breach without your knowledge.

NIST Framework Category: Respond
The respond function defines the activities required to act on detected cybersecurity incidents and supports the ability to contain the impact of a potential cyber threat.
Is your security telemetry stored in a cloud native platform? *

Many organizations have more than 50 security tools deployed across their environment, which isolates information—making accessibility challenging.

Storing all your telemetry in one place in the cloud means you can view it when you need to through a single pane of glass.

Do you monitor for cyberthreats 24x7? *

More than 35% of critical incidents are ticketed after hours, between 8 p.m. and 8 a.m. – when your staff have logged off for the day. Around the clock coverage is critical to eliminating blind spots – so seek the assistance of security operations partners if staffing this on your own is not feasible.

Do you have a security operations center? *

NIST Framework Category: Recover
The recover function outlines activities required to maintain resiliency and to restore any capabilities or services impaired due to a cyber threat.
Does your organization's recovery strategy include: reversion or replication, reconstitution, and replacement? *

A security recovery plan is an important practice to protect data and assets in the event of a security incident or data breach.

Effective security operations should include a team that keeps not only develops and administers the plan, but they’re also able to track success and make modifications to prevent future losses along the way.

Does your organization practice redundancy to provide multiple protected instances of critical resources? (i.e., maintaining protected backups, extra capacity for information storage, location redundancy, etc.) *

Your security recovery plan should also include elements of redundancy to minimize loss and organizational downtime.

Limit future damage to critical assets by adding redundancies such as protected backups, information backups, maintaining extra capacity, replicating hardware, and synching functionality across multiple locations to reduce exposure.

Do you perform post-incident activities to validate an incident has been resolved and is no longer persistent in your environment? *

Your Security Maturity Score:​

0%

Provide your information below to receive your full security maturity report in your inbox.

 
 
 
 
 
 

Total Score:   
Your journey to end cyber risk may be just beginning; the good news is you’re already on the road to improvement.

Suggestions on how to improve your score and harden your security posture through effective security operations are included in the full report sent to your email.
Ending cyber risk means reducing both the likelihood and impact of a threat. For security professionals, putting this into practice is much more complex.

While your organization has many of the security fundamentals in place, additional suggestions on how to improve your score and harden your security posture through effective security operations are included in the full report sent to your email.
Your organization is well ahead of the pack when it comes to your security maturity. Ending cyber risk means reducing both the likelihood and impact of a threat. For security professionals, putting this into practice is much more complex.

While your organization has many of the security fundamentals in place, additional suggestions on how to improve your score and harden your security posture through effective security operations are included in the full report sent to your email.

Learn More About Security Operations