How the scoring works

Twelve scored questions each carry 0 to 3 points. "Not sure" scores 0 and is flagged as a visibility gap. Questions are grouped into six domains with weights that sum to 100.

Domain score = (points earned / maximum points) x weight. The overall score is the sum, rounded to a whole number.

Bands

• Exposed (0 to 39). Basic controls missing. Start with verification and segmentation.
• Developing (40 to 64). Foundations exist; gaps an automated attacker would find quickly.
• Prepared (65 to 84). Good baseline; focus on speed, containment and governance.
• Leading (85 to 100). Keep testing; contribute to peer benchmarks.

Priority flags

Some answers raise a flag at the top of your results regardless of score: unverified internet exposure of OT, no separation between IT and OT, no isolation plan, or three or more "Not sure" answers.

Recommendations and signals

Each question maps to one recommendation per score level. Your top three gaps are ranked by domain weight multiplied by points missing. Architecture signals are rule-based, vendor-neutral options worth exploring. Every recommendation cites its guidance anchor: NCSC Cyber Assessment Framework v4.0, NCSC OT secure connectivity principles, or NCSC writing on agentic AI.

Limits

This is a self-assessment, not an audit. Scores reflect your answers only. Use it to start a conversation with your team.