How accurate is a five-question self-assessment?

It is directional, not diagnostic. Five questions can tell you roughly which tier you sit in and whether a full assessment is worth your time. They cannot tell you whether a control is configured correctly, which is what determines real exposure. Most organizations score themselves one tier higher than the evidence supports.

Do I have to give my email to get a score?

No. You can answer all five questions and see your score and tier without entering anything. An email is requested only if you want the sample report sent to you.

What is the difference between this and the Skyrocket Accelerated Gap Analysis?

This self-assessment is self-reported and takes two minutes. The Skyrocket Accelerated Gap Analysis is a practitioner-led engagement that delivers findings in roughly two weeks, scoring the same areas through interviews, configuration review, and technical validation. It produces a defensible baseline, ranked gaps, and a remediation roadmap.

Which framework is the scoring based on?

The NIST Cybersecurity Framework. The five questions map to its core functions, and the tier names are NIST's own published implementation tiers, so the vocabulary matches what your auditors and board already recognize.

We already had a penetration test. Do we need this too?

They answer different questions. A penetration test tells you whether a specific attack path works today. A maturity assessment tells you whether your program is structured to keep finding and closing those paths without being told.

Free Cyber Maturity Self-Assessment

Govern Name an accountable owner (CISO or vCISO) and tie your security strategy to business risk.

Identify Build a complete asset inventory and run a structured risk assessment against NIST CSF.

Protect Enforce MFA on critical systems and stand up continuous, role-based awareness training.

Detect Establish 24/7 monitoring (SOC or MDR) with defined alerting and escalation.

Respond Document and tabletop-test an incident response plan covering legal, PR, and notification deadlines.

Recover Implement immutable, offline backups and test restoration against your RTO/RPO.

Do you have a documented cybersecurity strategy with a named, accountable owner (CISO or vCISO)? Whether security has an owned, funded direction at {company}. No formal strategy or owner Owned informally, no documented policy Documented strategy and owner, reviewed occasionally Formal strategy tied to business risk, reported to leadership

How are cybersecurity risks from vendors and third parties managed? Your control over supply-chain exposure. Not tracked at all Informal questions only after problems Standard questionnaire or clause for key vendors Continuously monitored, built into procurement

Do you have a current, complete inventory of hardware, software, cloud, and data assets? You can’t protect what you can’t see. No formal inventory Partial, manual, infrequent Centralized, updated periodically Automated, continuous discovery

When did you last conduct a formal cybersecurity risk assessment? Against a framework like NIST CSF or ISO 27001. Never More than two years ago, informal Within 12–24 months, structured Continuously, updated as things change

How is access to your most critical systems and data controlled? Who at {company} can reach what, and how it’s enforced. Shared logins or minimal restrictions Individual accounts, basic passwords MFA on critical systems, periodic reviews MFA plus Zero Trust and automated least-privilege

How often do employees get security awareness training and phishing simulations? Your people are the largest attack surface. Never Onboarding only Annually, all staff Continuous, role-based, with phishing tests

Do you have around-the-clock monitoring and alerting across your environment? How quickly a threat would surface. Only basic antivirus Logs exist, reviewed reactively A SOC or SIEM during business hours 24/7 SOC or MDR with active threat hunting

How would you detect a compromised account or endpoint today? The realistic path from compromise to awareness. We likely wouldn’t know From user complaints or obvious symptoms Scheduled review of EDR/AV alerts Automated detection triggers a defined response

Do you have a documented, tested incident response plan? {first_name}, this is the one most teams overestimate: a plan you’ve rehearsed, not just written. No plan exists Informal, never tested Documented and tabletop-tested Tested plan covering roles, legal/PR, insurance

If a breach happened today, how would you meet notification deadlines? Regulators and contracts impose hard timelines. We’d figure it out then Know who to call, no process Documented but untested recently Rehearsed, counsel-reviewed, meets deadlines

How confident are you that backups can restore critical systems after ransomware? Backups only count if restoration is proven. Not sure what’s actually backed up Backups exist, never test-restored Tested annually against RTO/RPO Immutable, offline, regularly test-restored

Do you have a business continuity / disaster recovery plan that’s kept current? How {company} keeps operating through disruption. No plan exists Old, not updated in years Reviewed and updated annually Living document, updated after every major change

Partial You’re exposed in ways you likely can’t see yet. Before your next audit, renewal, or incident, get a scored baseline of where the real gaps are.

Risk-Informed You’re doing the right things in pockets, the most common starting point for mid-market organizations. The next step is standardizing what already works.

Repeatable Your program is consistent and defensible. Sharpening detection and response is usually where the remaining risk hides.

Adaptive Your program adapts as fast as the threats do. An independent benchmark against NIST CSF 2.0 validates it, and finds what even a strong team can miss.

Skyrocket · Stage 1 · Assess

How mature is your cybersecurity program, really?

You patch what breaks and react to what alerts. But when your board, your insurer, or your next auditor asks where you actually stand, “we think we’re fine” isn’t an answer they’ll accept. This 2-minute self-check gives you a directional maturity score across the six NIST CSF functions, and shows where to focus first.

The most common blind spot is assuming you’re covered. Attackers, auditors, and insurers grade on evidence, not intent. Start by seeing where you stand.

The Skyrocket journey

Assess

You start here

Prioritize

Implement

Operate

12 quick questions · No answer is wrong · Your score at the end

First, the basics

Who are we tailoring this for?

Just so the questions read properly, and so we can address the results to you.

First name

Please enter your first name.

Last name

Please enter your last name.

No email needed yet

Thanks, {first_name}

Two details so the questions fit your situation

Maturity looks different for a 40-person firm than a 4,000-person one, and different again depending on where you sit. This shapes how we read your answers.

Your role

Please enter your role.

Company

Please enter your company.

12 questions from here

Select an option to continue

Last step

Where should we send {company}’s results?

{first_name}, your score and six-function snapshot are on the next screen. We’ll email a copy so you have it for your records, and so you can forward it.

Work email

Please enter a valid work email.

One field, then your results

{company} · your starting altitude

0 out of 100

—

Your maturity altitude

NIST CSF 2.0 · six-function breakdown

Where to focus first

Continue {company}’s Skyrocket journey

You’ve completed a directional Assess. Your formal Skyrocket Maturity Score comes from an expert-led, evidence-based assessment, benchmarked against NIST CSF 2.0 and delivered with a Gap Analysis report and executive walkthrough. From there, Skyrocket sequences the climb: Prioritize (Quick-Win Sprint) → Implement (Managed Security Services) → Operate (Continuous vCISO Oversight).

Book your Skyrocket Assessment Get the sample report See what the full assessment includes →

Grounded in standards. Scored against evidence. Designed to pass the conversations you’ll have with auditors, examiners, insurers, and your board: NIST CSF 2.0 · CIS Controls v8 · CISA Cybersecurity Performance Goals

Reference

The four NIST CSF implementation tiers

Your score bands into one of the four implementation tiers published in the NIST Cybersecurity Framework. The tier matters more than the number. It describes how consistently security decisions get made, not how many tools are deployed.

Tier	Score	What it describes
Partial	0–25	Cybersecurity is handled case by case. Risk decisions happen without organization-wide awareness, and practice varies between teams.
Risk-Informed	26–50	Leadership has approved risk practices, but they are applied inconsistently and are not yet policy across the organization.
Repeatable	51–75	Practices are formal policy, applied consistently, and updated as requirements and the threat landscape change.
Adaptive	76–100	The program improves continuously from lessons learned and predictive indicators, and adapts ahead of emerging threats.

How this self-check is scored

Twelve questions, two per NIST CSF 2.0 function (Govern, Identify, Protect, Detect, Respond, Recover). Each answer maps to an implementation tier worth 0, 33, 67, or 100. Each function score is the average of its two answers; the overall score is the average of the six function scores. Grounded in NIST CSF 2.0, CIS Controls v8, and the CISA Cybersecurity Performance Goals.

What this is, and what it isn’t

This is a directional, self-reported starting point rather than an assessment. A full engagement scores the same areas against evidence (interviews, configuration review, and technical validation), and most organizations land lower than they expect. Results here are indicative, based on our engagements, and not a guarantee of outcome.

DigitalEra Group · Doral, Florida · serving the United States, Latin America, and the Caribbean since 2000. SOC 2 Type II certified.

DigitalEra · Empowering Confidence.
Skyrocket: a DigitalEra cybersecurity maturity journey. This self-check provides a directional indicator only and is not a formal Skyrocket Maturity Assessment.

Active incident? Certified IR professionals respond 24/7.