4
Available Assessment Domains
Organizational Readiness for Implementing the Essential Cybersecurity Controls (ECC)
Identify Readiness Gaps and Prioritize Cybersecurity Improvements
An automated self-assessment that helps your organization measure its readiness to implement the Essential Cybersecurity Controls (ECC) issued by the National Cybersecurity Authority. It covers 4 domains, including cybersecurity governance, cyber defense, cybersecurity resilience, and third-party and cloud computing cybersecurity, helping identify implementation gaps, prioritize improvements, and build an actionable roadmap
Who Is This Assessment For?
This assessment is designed for cybersecurity professionals and governance, risk, compliance, and IT teams seeking to review the organization’s readiness to implement the ECC and identify improvement gaps. Business continuity and third-party management professionals should also be involved where relevant to the domains being assessed
27
Target Organizational Capability
256
Diagnostic Question
69
Recommendations & Improvement Roadmap
Essential Cybersecurity Controls Readiness Assessment Domains
Domain 1: Cybersecurity Governance
Evaluates the organization’s governance of cybersecurity through strategy, management, policies, responsibilities, risk management, technology projects, regulatory alignment, assurance, human resources, awareness, and training.
Domain2: Cybersecurity Defense
Evaluates the organization’s implementation of technical and operational cybersecurity controls to protect information and technology assets, including asset management, access control, systems, networks, data, vulnerabilities, monitoring, incident management, physical security, and web applications.
Domain3: Cybersecurity Resilience
Evaluates the organization’s integration of cybersecurity resilience requirements into business continuity management to minimize the impact of cyber-related disruptions on critical electronic services and information processing systems and facilities.
Domain4: Third-Party and Cloud Computing Cybersecurity
Evaluates the organization’s management of cybersecurity risks arising from third parties, outsourcing, managed services, cloud computing, and hosting arrangements, including contractual requirements, risk assessment, data protection, incident communication, and regulatory requirements.
Does the Assessment Result Demonstrate Compliance with the ECC?
No. The result indicates the level of readiness based on the responses provided and helps identify gaps. It does not constitute compliance certification or approval by the National Cybersecurity Authority, nor does it replace verification of control implementation and review of supporting evidence
Does the Assessment Include Technical Scanning or Penetration Testing?
The assessment is self-administered and relies on responses regarding implemented practices and controls. It does not constitute automated system scanning or penetration testing and does not replace appropriate technical testing and reviews
What Should I Prepare Before Completing the Assessment?
Prepare the policies, procedures, records, and reports relevant to the domains being assessed, such as documentation related to risk management, access and authorization, incidents, business continuity, and third-party contracts. Involve the relevant subject-matter owners to ensure the responses accurately reflect actual implementation
Is the Assessment a Formal Audit or Compliance Certification?
The assessment is a self-assessment tool for measuring the maturity of governance practices and identifying opportunities for improvement. It does not constitute an independent audit or compliance certification and does not replace reviews or regulatory requirements applicable to the organization
How Can You Use the Assessment Results?
Review the gaps and recommendations, then prioritize improvement actions based on risk, the criticality of systems and services, and the requirements applicable to your organization. Assign responsibilities and target dates, track implementation, and reassess to review progress
Try One Domain Assessment for Free
Domain3: Cybersecurity Resilience
Evaluates the organization’s integration of cybersecurity resilience requirements into business continuity management to minimize the impact of cyber-related disruptions on critical electronic services and information processing systems and facilities.
100% Automated Assessment
Discover strengths and clearly identify improvement priorities
Prioritize based on the organization’s current state
Executive Dashboard
Fast Performance
Fast, smooth access to assessments, results, and recommendations
Advanced Security
Secure, reliable protection for your assessment data and platform access
Free Review Session
Free session to review results, priorities, actions
Smart Analytics
Clear insights from assessment results, scores, and improvement priorities.