Cybersecurity Assessment Template
📄
💾 Downloadcybersecurity_assessment_template.md
Markdown • 28,290 bytes
--- title: "Cybersecurity Assessment Template" methodology: "universal" complexity: "advanced" owner: "mirichard" updated: "2026-09-19" primary_principles: ["risk-optimization"] secondary_principles: ["evidence-based-decisions", "stewardship"] principle_rationale: "Bounds a security posture assessment around assets, threats and vulnerabilities so owners can prioritize evidence-backed protection measures." --- # Cybersecurity Assessment Template ## When to Use - When assessing an IT environment's security posture before prioritizing improvements. - When threat, vulnerability, asset, and response evidence need a bounded assessment scope. ## When NOT to Use - As certification of security or a replacement for authorized technical testing. - Do not use a completed template or example configuration as proof of fitness for the actual environment. See [Template as substitute for judgment](../../../../../docs/principles/anti-patterns.md#template-judgment). ## Pairs Well With - [Risk Assessment Template](../../../../../domains/measurement/industry-specializations/information-technology/cybersecurity/risk_assessment_template.md). - [Incident Response Template](../../../../../domains/measurement/industry-specializations/information-technology/cybersecurity/incident_response_template.md). Selection context: Measurement domain; universal methodology; advanced complexity. Match the situations above to project phase, risk, team size, and industry using the [decision-engine context model](../../../../../meta/architecture-research/800-801-context-assessment-model.md). ## Framework and response applicability When using NIST CSF, map the assessment to the six CSF 2.0 functions, including Govern. Record decision authority, risk appetite, oversight, and supply-chain responsibilities as well as technical controls. The [NIST CSF 2.0 overview](https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework) explains the governance addition. Example response times and notification periods must be replaced by the approved service, incident, and jurisdiction-specific requirements. ## Document Control | Document Information | | |----------------------|--------------------------------------| | Document Title | Cybersecurity Assessment Template | | Document Version | 1.0 | | Last Updated | YYYY-MM-DD | | Document Owner | [Security Assessment Lead] | | Document Status | [Draft/Under Review/Approved] | | Confidentiality | [Internal/Confidential/Restricted] | | Document ID | CSA-[Organization ID]-[YYYY-MM] | ### Revision History | Version | Date | Description of Changes | Author | Approver | |---------|------------|------------------------|---------------|----------------| | 1.0 | YYYY-MM-DD | Initial draft | [Name/Title] | [Name/Title] | ### Document Approvals | Name | Role/Title | Signature | Date | |------------------|----------------------------------|------------------|------------| | [Approver Name] | CISO/Head of Security | ________________ | __________ | | [Approver Name] | IT Director | ________________ | __________ | | [Approver Name] | Risk/Compliance Officer | ________________ | __________ | | [Approver Name] | [Other relevant stakeholders] | ________________ | __________ | --- ## 1. Executive Summary ### 1.1 Assessment Overview **Organization/System Name:** [Name of organization or system assessed] **Assessment Period:** [Start date] to [End date] **Assessment Type:** [Comprehensive/Targeted/Compliance-focused] **Assessment Purpose:** [Brief description of why the assessment was conducted, including any compliance or business requirements driving the assessment] ### 1.2 Key Findings Summary [High-level summary of key findings, grouped by criticality. Include a brief narrative of the organization's overall security posture] #### Critical Findings * [Brief description of critical finding 1] * [Brief description of critical finding 2] #### High-Risk Findings * [Brief description of high-risk finding 1] * [Brief description of high-risk finding 2] #### Medium-Risk Findings * [Brief description of medium-risk finding 1] * [Brief description of medium-risk finding 2] ### 1.3 Security Posture Summary [Provide a high-level overview of the organization's security posture, including areas of strength and significant weaknesses] | Security Domain | Maturity Level | Risk Level | |---------------------------|-------------------------|-------------------| | Network Security | [Low/Medium/High] | [Low/Medium/High] | | Endpoint Security | [Low/Medium/High] | [Low/Medium/High] | | Access Control | [Low/Medium/High] | [Low/Medium/High] | | Data Security | [Low/Medium/High] | [Low/Medium/High] | | Cloud Security | [Low/Medium/High] | [Low/Medium/High] | | Application Security | [Low/Medium/High] | [Low/Medium/High] | | Security Operations | [Low/Medium/High] | [Low/Medium/High] | | Security Governance | [Low/Medium/High] | [Low/Medium/High] | ### 1.4 Recommendation Summary [Summarize the highest priority recommendations, including immediate actions needed] #### Immediate Actions * [Immediate action 1] * [Immediate action 2] #### Short-term Actions (0-3 Months) * [Short-term recommendation 1] * [Short-term recommendation 2] #### Medium-term Actions (3-6 Months) * [Medium-term recommendation 1] * [Medium-term recommendation 2] #### Long-term Actions (6+ Months) * [Long-term recommendation 1] * [Long-term recommendation 2] --- ## 2. Assessment Scope & Methodology ### 2.1 Scope Definition [Define the scope of the assessment, detailing what was included and excluded] #### In-scope Items * [List of in-scope systems, applications, networks, facilities, processes, etc.] #### Out-of-scope Items * [List of explicitly out-of-scope items] #### Assessment Boundaries * [Description of logical and physical boundaries of the assessment] ### 2.2 Assessment Methodology [Describe the methodology and framework(s) used for the assessment] #### Assessment Framework(s) * [Framework 1, e.g., NIST CSF, ISO 27001, CIS Controls] * [Framework 2] #### Assessment Approach [Describe the overall approach to the assessment, including: - Phases of the assessment - Types of testing performed - Tools and techniques used - Evidence collection methods] #### Assessment Team | Name | Role | Responsibilities | |------|------|-----------------| | [Name] | Assessment Lead | [Responsibilities] | | [Name] | Technical Assessor | [Responsibilities] | | [Name] | [Role] | [Responsibilities] | ### 2.3 Assessment Limitations [Document any limitations or constraints encountered during the assessment that may impact the findings or conclusions] --- ## 3. Current Security Posture ### 3.1 Network Security #### 3.1.1 Network Architecture [Describe and evaluate the current network architecture, segmentation, and zones] #### 3.1.2 Perimeter Security [Evaluate perimeter security controls including firewalls, IDS/IPS, and DMZ configuration] #### 3.1.3 Internal Network Security [Evaluate internal network security controls, including segmentation, monitoring, and traffic control] #### 3.1.4 Wireless Network Security [Evaluate wireless network security, including encryption, authentication, and guest access] #### 3.1.5 Remote Access [Evaluate remote access solutions, including VPN, MFA, and monitoring] #### 3.1.6 Network Monitoring and Response [Evaluate network monitoring capabilities, including logging, alerting, and incident response] ### 3.2 Endpoint Security #### 3.2.1 Endpoint Protection [Evaluate endpoint protection solutions, including antivirus, EDR, and application control] #### 3.2.2 Patch Management [Evaluate patch management processes for operating systems and applications] #### 3.2.3 Configuration Management [Evaluate system hardening and configuration management practices] #### 3.2.4 Mobile Device Security [Evaluate mobile device security, including MDM solutions and policies] #### 3.2.5 Removable Media Controls [Evaluate controls for removable media, including USB devices and external drives] ### 3.3 Access Control #### 3.3.1 Identity Management [Evaluate identity management practices, including provisioning, review, and deprovisioning] #### 3.3.2 Authentication [Evaluate authentication mechanisms, including password policies and MFA implementation] #### 3.3.3 Authorization [Evaluate authorization controls, including role-based access and least privilege principles] #### 3.3.4 Privileged Access Management [Evaluate privileged access management, including administrative account controls] #### 3.3.5 Physical Access Controls [Evaluate physical access controls to facilities, data centers, and sensitive areas] ### 3.4 Data Security #### 3.4.1 Data Classification [Evaluate data classification schemes and implementation] #### 3.4.2 Data Protection [Evaluate data protection mechanisms for data at rest, in transit, and in use] #### 3.4.3 Data Loss Prevention [Evaluate DLP solutions and their effectiveness] #### 3.4.4 Encryption Management [Evaluate encryption implementation and key management] #### 3.4.5 Data Retention and Destruction [Evaluate data retention policies and secure data destruction practices] ### 3.5 Cloud Security #### 3.5.1 Cloud Service Provider Security [Evaluate security of cloud service providers and shared responsibility model implementation] #### 3.5.2 Cloud Configuration [Evaluate cloud configuration, including identity management and access controls] #### 3.5.3 Cloud Data Protection [Evaluate data protection in cloud environments, including encryption and DLP] #### 3.5.4 Cloud Monitoring and Logging [Evaluate cloud monitoring, logging, and incident response capabilities] ### 3.6 Application Security #### 3.6.1 Secure Development Practices [Evaluate secure development lifecycle and practices] #### 3.6.2 Application Vulnerabilities [Evaluate common vulnerabilities in applications, including OWASP Top 10 issues] #### 3.6.3 API Security [Evaluate API security, including authentication, authorization, and input validation] #### 3.6.4 Web Application Security [Evaluate web application security, including authentication, session management, and input validation] #### 3.6.5 Application Testing [Evaluate application security testing practices, including SAST, DAST, and penetration testing] --- ## 4. Threat Assessment ### 4.1 External Threats #### 4.1.1 Threat Actors [Identify and evaluate potential external threat actors relevant to the organization] | Threat Actor Type | Motivation | Capability | Targeting Likelihood | |-------------------|------------|------------|----------------------| | Nation-state | [Motivation] | [High/Medium/Low] | [High/Medium/Low] | | Organized Crime | [Motivation] | [High/Medium/Low] | [High/Medium/Low] | | Hacktivists | [Motivation] | [High/Medium/Low] | [High/Medium/Low] | | [Other] | [Motivation] | [High/Medium/Low] | [High/Medium/Low] | #### 4.1.2 External Attack Vectors [Identify and evaluate potential external attack vectors] | Attack Vector | Exposure Level | Existing Controls | Control Effectiveness | |---------------|----------------|-------------------|-----------------------| | Phishing | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | Web Application Attacks | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | Network-based Attacks | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | [Other] | [High/Medium/Low] | [Controls] | [High/Medium/Low] | ### 4.2 Internal Threats #### 4.2.1 Insider Threat Profile [Evaluate potential insider threats, including malicious and non-malicious insiders] #### 4.2.2 Internal Attack Vectors [Identify and evaluate potential internal attack vectors] | Attack Vector | Exposure Level | Existing Controls | Control Effectiveness | |---------------|----------------|-------------------|-----------------------| | Privileged User Abuse | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | Data Exfiltration | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | Social Engineering | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | [Other] | [High/Medium/Low] | [Controls] | [High/Medium/Low] | ### 4.3 Industry-Specific Threats #### 4.3.1 Industry Threat Landscape [Describe threat landscape specific to the organization's industry] #### 4.3.2 Recent Industry Attacks [Document recent attacks or breaches in the industry and their relevance] #### 4.3.3 Industry-Specific Attack Vectors [Identify attack vectors specific to the organization's industry] | Attack Vector | Exposure Level | Existing Controls | Control Effectiveness | |---------------|----------------|-------------------|-----------------------| | [Vector 1] | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | [Vector 2] | [High/Medium/Low] | [Controls] | [High/Medium/Low] | | [Vector 3] | [High/Medium/Low] | [Controls] | [High/Medium/Low] | --- ## 5. Vulnerability Assessment ### 5.1 Critical Vulnerabilities [List and describe critical vulnerabilities discovered during the assessment] | ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence | |----|---------------|-------------------|-------------|------------|----------| | CR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | | CR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | ### 5.2 High-Risk Findings [List and describe high-risk vulnerabilities discovered during the assessment] | ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence | |----|---------------|-------------------|-------------|------------|----------| | HR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | | HR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | ### 5.3 Medium-Risk Findings [List and describe medium-risk vulnerabilities discovered during the assessment] | ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence | |----|---------------|-------------------|-------------|------------|----------| | MR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | | MR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | ### 5.4 Low-Risk Findings [List and describe low-risk vulnerabilities discovered during the assessment] | ID | Vulnerability | Affected System(s) | Description | CVSS Score | Evidence | |----|---------------|-------------------|-------------|------------|----------| | LR-01 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | | LR-02 | [Vulnerability Name] | [System(s)] | [Description] | [Score] | [Evidence] | --- ## 6. Compliance Status ### 6.1 Regulatory Requirements #### 6.1.1 Applicable Regulations [List applicable regulations and legal requirements] | Regulation | Applicability | Compliance Status | Major Gaps | |------------|---------------|-------------------|------------| | [Regulation] | [Applicability] | [Status] | [Gaps] | | [Regulation] | [Applicability] | [Status] | [Gaps] | #### 6.1.2 Regulatory Compliance Assessment [Evaluate compliance with applicable regulatory requirements] ### 6.2 Industry Standards #### 6.2.1 Applicable Standards [List applicable industry standards and frameworks] | Standard | Applicability | Compliance Status | Major Gaps | |----------|---------------|-------------------|------------| | [Standard] | [Applicability] | [Status] | [Gaps] | | [Standard] | [Applicability] | [Status] | [Gaps] | #### 6.2.2 Standards Compliance Assessment [Evaluate compliance with applicable industry standards] ### 6.3 Internal Policies #### 6.3.1 Policy Inventory [List internal security policies and standards] | Policy | Version | Last Review | Compliance Status | |--------|---------|-------------|-------------------| | [Policy] | [Version] | [Date] | [Status] | | [Policy] | [Version] | [Date] | [Status] | #### 6.3.2 Policy Compliance Assessment [Evaluate compliance with internal policies and standards] --- ## 7. Incident Response Readiness ### 7.1 IR Plan Assessment #### 7.1.1 IR Plan Review [Review and evaluate the incident response plan] | Component | Status | Adequacy | Gaps/Issues | |-----------|--------|----------|-------------| | Plan Structure | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] | | Roles & Responsibilities | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] | | Incident Classification | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] | | Response Procedures | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] | | Communication Plan | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] | | Testing & Maintenance | [Present/Absent] | [Adequate/Inadequate] | [Gaps/Issues] | #### 7.1.2 IR Plan Recommendations [Provide recommendations to improve the incident response plan] ### 7.2 Team Readiness #### 7.2.1 IR Team Structure [Evaluate the structure of the incident response team] #### 7.2.2 IR Team Skills and Training [Evaluate the skills and training of the incident response team] #### 7.2.3 IR Team Recommendations [Provide recommendations to improve the incident response team] ### 7.3 Tools and Resources #### 7.3.1 IR Tools Inventory [Inventory and evaluate incident response tools and resources] | Tool/Resource | Purpose | Effectiveness | Gaps/Issues | |---------------|---------|---------------|-------------| | [Tool] | [Purpose] | [High/Medium/Low] | [Gaps/Issues] | | [Tool] | [Purpose] | [High/Medium/Low] | [Gaps/Issues] | #### 7.3.2 IR Tools and Resources Recommendations [Provide recommendations to improve incident response tools and resources] --- ## 8. Security Controls Assessment ### 8.1 Technical Controls #### 8.1.1 Technical Controls Inventory [Inventory and evaluate technical security controls] | Control Category | Controls | Effectiveness | Gaps/Issues | |------------------|----------|---------------|-------------| | Preventive | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Detective | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Corrective | [Controls] | [High/Medium/Low] | [Gaps/Issues] | #### 8.1.2 Technical Controls Recommendations [Provide recommendations to improve technical security controls] ### 8.2 Administrative Controls #### 8.2.1 Administrative Controls Inventory [Inventory and evaluate administrative security controls] | Control Category | Controls | Effectiveness | Gaps/Issues | |------------------|----------|---------------|-------------| | Policies & Standards | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Procedures | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Training & Awareness | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | HR Security | [Controls] | [High/Medium/Low] | [Gaps/Issues] | #### 8.2.2 Administrative Controls Recommendations [Provide recommendations to improve administrative security controls] ### 8.3 Physical Controls #### 8.3.1 Physical Controls Inventory [Inventory and evaluate physical security controls] | Control Category | Controls | Effectiveness | Gaps/Issues | |------------------|----------|---------------|-------------| | Facility Access | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Environmental | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Physical Media | [Controls] | [High/Medium/Low] | [Gaps/Issues] | | Monitoring | [Controls] | [High/Medium/Low] | [Gaps/Issues] | #### 8.3.2 Physical Controls Recommendations [Provide recommendations to improve physical security controls] --- ## 9. Risk Assessment ### 9.1 Risk Register [Compile a comprehensive risk register based on assessment findings] | ID | Risk Description | Affected Assets | Threat Source | Vulnerability | Inherent Risk | Existing Controls | Residual Risk | |----|------------------|-----------------|---------------|---------------|---------------|-------------------|---------------| | R-01 | [Description] | [Assets] | [Threat] | [Vulnerability] | [H/M/L] | [Controls] | [H/M/L] | | R-02 | [Description] | [Assets] | [Threat] | [Vulnerability] | [H/M/L] | [Controls] | [H/M/L] | | R-03 | [Description] | [Assets] | [Threat] | [Vulnerability] | [H/M/L] | [Controls] | [H/M/L] | ### 9.2 Impact Analysis #### 9.2.1 Business Impact [Analyze the potential business impact of identified risks] | Risk ID | Financial Impact | Operational Impact | Reputational Impact | Regulatory Impact | Overall Impact | |---------|------------------|--------------------|--------------------|-------------------|----------------| | R-01 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | | R-02 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | | R-03 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | #### 9.2.2 Critical Asset Impact [Analyze the potential impact on critical assets] ### 9.3 Likelihood Assessment [Assess the likelihood of identified risks] | Risk ID | Threat Capability | Vulnerability Exposure | Controls Effectiveness | Overall Likelihood | |---------|--------------------|------------------------|------------------------|-------------------| | R-01 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | | R-02 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | | R-03 | [H/M/L] | [H/M/L] | [H/M/L] | [H/M/L] | --- ## 10. Recommendations ### 10.1 Critical Actions [Prioritized list of critical actions to address immediate security concerns] | ID | Recommendation | Related Finding(s) | Priority | Complexity | Resource Requirements | Timeframe | |----|----------------|---------------------|----------|------------|----------------------|-----------| | CA-01 | [Action] | [Finding(s)] | Critical | [H/M/L] | [Requirements] | Immediate | | CA-02 | [Action] | [Finding(s)] | Critical | [H/M/L] | [Requirements] | Immediate | ### 10.2 Short-term Improvements [Recommendations for short-term security improvements (0-3 months)] | ID | Recommendation | Related Finding(s) | Priority | Complexity | Resource Requirements | Timeframe | |----|----------------|---------------------|----------|------------|----------------------|-----------| | ST-01 | [Action] | [Finding(s)] | High | [H/M/L] | [Requirements] | 0-3 months | | ST-02 | [Action] | [Finding(s)] | High | [H/M/L] | [Requirements] | 0-3 months | ### 10.3 Long-term Strategy [Recommendations for long-term security strategy (3+ months)] | ID | Recommendation | Related Finding(s) | Priority | Complexity | Resource Requirements | Timeframe | |----|----------------|---------------------|----------|------------|----------------------|-----------| | LT-01 | [Action] | [Finding(s)] | Medium | [H/M/L] | [Requirements] | 3-6 months | | LT-02 | [Action] | [Finding(s)] | Medium | [H/M/L] | [Requirements] | 6-12 months | | LT-03 | [Action] | [Finding(s)] | Low | [H/M/L] | [Requirements] | 12+ months | --- ## 11. Implementation Roadmap ### 11.1 Timeline [Provide a visual timeline of recommended actions] | Timeline | Critical Actions | Short-term Actions | Long-term Actions | |----------|------------------|-------------------|-------------------| | Immediate | [Actions] | | | | 0-1 Month | [Actions] | [Actions] | | | 1-3 Months | [Actions] | [Actions] | | | 3-6 Months | | [Actions] | [Actions] | | 6-12 Months | | | [Actions] | | 12+ Months | | | [Actions] | ### 11.2 Resource Requirements [Detailed resource requirements for implementing recommendations] #### 11.2.1 Personnel Resources [Personnel resources required, including roles, skills, and time commitments] #### 11.2.2 Technology Resources [Technology resources required, including hardware, software, and services] #### 11.2.3 Budget Estimates [Estimated costs for implementing recommendations] | Category | Short-term (0-3 months) | Medium-term (3-6 months) | Long-term (6+ months) | Total | |----------|--------------------------|--------------------------|----------------------|-------| | Personnel | [Cost] | [Cost] | [Cost] | [Total] | | Hardware | [Cost] | [Cost] | [Cost] | [Total] | | Software | [Cost] | [Cost] | [Cost] | [Total] | | Services | [Cost] | [Cost] | [Cost] | [Total] | | Training | [Cost] | [Cost] | [Cost] | [Total] | | Other | [Cost] | [Cost] | [Cost] | [Total] | | **Total** | [Total] | [Total] | [Total] | [Grand Total] | ### 11.3 Budget Estimates [Provide detailed budget estimates for implementing recommendations] --- ## 12. Appendices ### Appendix A: Detailed Scan Results [Include detailed technical scan results, such as vulnerability scan reports, penetration testing results, etc.] ### Appendix B: Testing Methodology [Provide detailed information about the testing methodology used during the assessment] #### B.1 Vulnerability Assessment Methodology [Describe the methodology used for vulnerability assessment] #### B.2 Penetration Testing Methodology [Describe the methodology used for penetration testing, if applicable] #### B.3 Tools and Techniques [List and describe the tools and techniques used during the assessment] | Tool | Purpose | Configuration | Version | |------|---------|--------------|---------| | [Tool] | [Purpose] | [Configuration] | [Version] | | [Tool] | [Purpose] | [Configuration] | [Version] | ### Appendix C: Evidence Collection [Describe the evidence collection process and include relevant evidence] #### C.1 Evidence Collection Methodology [Describe the methodology used for evidence collection] #### C.2 Evidence Inventory [Provide an inventory of evidence collected during the assessment] | ID | Evidence Type | Description | Collection Date | Collected By | |----|---------------|-------------|-----------------|--------------| | E-01 | [Type] | [Description] | [Date] | [Name] | | E-02 | [Type] | [Description] | [Date] | [Name] | ### Appendix D: Risk Assessment Methodology [Describe the risk assessment methodology used, including risk scoring criteria] #### D.1 Risk Assessment Framework [Describe the risk assessment framework used] #### D.2 Risk Scoring Criteria [Describe the criteria used for risk scoring] ##### Impact Criteria | Level | Financial | Operational | Reputational | Regulatory | |-------|-----------|-------------|--------------|------------| | High | [Criteria] | [Criteria] | [Criteria] | [Criteria] | | Medium | [Criteria] | [Criteria] | [Criteria] | [Criteria] | | Low | [Criteria] | [Criteria] | [Criteria] | [Criteria] | ##### Likelihood Criteria | Level | Criteria | |-------|----------| | High | [Criteria] | | Medium | [Criteria] | | Low | [Criteria] | ##### Risk Matrix | Likelihood/Impact | Low Impact | Medium Impact | High Impact | |-------------------|------------|---------------|-------------| | High Likelihood | Medium | High | Critical | | Medium Likelihood | Low | Medium | High | | Low Likelihood | Low | Low | Medium | ### Appendix E: Compliance Frameworks Mapping [Map assessment findings to relevant compliance frameworks] | Finding ID | NIST CSF | ISO 27001 | [Other Framework] | |------------|----------|-----------|-------------------| | [ID] | [Mapping] | [Mapping] | [Mapping] | | [ID] | [Mapping] | [Mapping] | [Mapping] | ### Appendix F: Remediation Resources [Provide resources to assist with remediation of findings] #### F.1 Remediation Guides [Provide guides or references for remediating common issues] #### F.2 Vendor Resources [Provide vendor-specific resources for remediation] #### F.3 Security Best Practices [Provide references to security best practices] ### Appendix G: Glossary [Provide a glossary of terms used in the assessment report] ### Appendix H: References [List references and sources used in the assessment] 1. NIST Special Publication 800-115: Technical Guide to Information Security Testing and Assessment 2. NIST Special Publication 800-30: Guide for Conducting Risk Assessments 3. OWASP Testing Guide 4. CIS Critical Security Controls 5. [Other references]