The eight controls, read as an instrument.
One page a sponsor signs for every company it owns. The watch reads what you mark: gold for a yes, red for a no, a broken baton for a control nobody can answer for. The count is computed in your browser, and nothing you answer leaves this page.
Free · two minutes · nothing stored, nothing sent · the practice
Answer as the company stands today. A control that is planned, half done or true for most people is a no. A control nobody in the room can answer for is a not sure, and that answer is as useful as the other two.
- 01Identity
- 02Endpoints
- 03Backups
- 04Mail and domain
- 05Patching
- 06Privileged accounts
- 07The incident plan
- 08Providers
Does every account that reaches mail, money or customer data sign in with a second factor, administrators with a phishing-resistant one, and nobody excepted?
Does every laptop, phone and server carry detection and response, with a named person reading the alerts?
Are the backups kept apart from the network, and was a full restore performed on a date you can name, and timed?
Are the sender rules enforced, is external mail marked, and were the forwarding rules on every mailbox reviewed this quarter?
Are critical patches applied inside thirty days, and on internet-facing systems inside seven, with the exceptions written down?
Are the administrator and service accounts counted, named, owned by a person and reduced this quarter?
Does a plan exist with named roles and the notification clocks of every regime that binds you written in, rehearsed in the last year?
Is there a register of every provider with privileged access, each with its attestation, its contract terms and a review date?
The standard is bought once, and read across the estate.
The eight are the first page of the baseline a buyer recognises. The identity month closes the first control in four weeks; the rest follow in phases you can stop. Each lands in the company’s own record with a date, where the next questionnaire is answered from it.
The same eight across ten companies, signed once, read on one page every quarter from the companies’ own records, aggregates only. A company that answers eight of eight on paper is asked for the evidence; one that answers three is given the identity month first.
The office, the family and the holdings each answer the eight, and the office adds the five questions a stranger with a telephone would test: Guide 13.
Nothing. They are held in the page while it is open and gone when it closes. If you want the house to read them, the button below puts the count in a message you send yourself.
Eight controls, each with a date, before a buyer or a bank asks.
Start a conversation → The practice →The identity month in four weeks · the baseline in phases · the seat by the month