A structured approach to understanding cyber-security posture.
CCR combines a structured cyber-security assessment, evidence awareness, connected-device considerations and prioritised findings to help organisations understand where controls appear stronger, where gaps may exist and what should be improved first.
An indicative measure of assessed control readiness across applicable CCR security domains.
A separate measure showing how much supporting evidence exists for the assessed posture.
A plain-English classification expressed as Low, Moderate, Elevated or High.
From answers to practical priorities
CCR separates assessment, evidence and remediation so that a reported security control is not automatically treated as evidence-supported assurance.
Ten areas of cyber-security readiness
The Quick Check currently organises assessment controls across ten CCR security domains covering traditional business IT, people, recovery and connected technology.
Governance & Risk
How cyber-security responsibility, policies and risk oversight are established.
Asset Management
How business technology, systems and important digital assets are identified and managed.
Identity & Access
How access to business accounts, systems and privileged services is controlled.
Endpoint & Configuration
How computers, applications and business devices are configured, maintained and updated.
Network Security
How business networks are protected and separated from less-trusted environments where appropriate.
Data Protection
How sensitive business and personal information is protected against inappropriate access, loss or disclosure.
Backup & Recovery
How important business information is backed up and recoverability is supported.
Detection & Incident Response
How the organisation prepares for, identifies and responds to potential cyber-security incidents.
People & Security Awareness
How employees and other users are supported in understanding their cyber-security responsibilities.
IoT & Connected Devices
How connected technology such as CCTV, POS terminals, printers, sensors and access-control systems is identified and secured.
Control readiness and evidence are deliberately separated.
CCR Readiness represents assessed implementation of applicable controls. Evidence Confidence is reported independently because an organisation may report strong controls while having limited supporting evidence available.
This could indicate a strong reported posture with limited supporting evidence.
Clear risk communication without false precision.
The Quick Check expresses assessed exposure using four categories rather than presenting a second precise-looking risk percentage.
Not every security claim has the same level of support.
CCR distinguishes between reported controls and controls with stronger supporting provenance. Evidence Confidence does not replace the Readiness Score; it provides additional context about the assurance supporting that assessment.
The organisation reports that the control is implemented.
Relevant supporting evidence has been supplied for the control.
An appropriate authorised technical observation supports the assessment.
A relevant assessment or evidence item has been reviewed by an authorised expert.
Identify gaps. Prioritise what matters first.
Highest assessment priority requiring prompt attention.
Important control gaps that should be prioritised.
Material improvements that should be planned and addressed.
Lower-priority improvement opportunities or planning items.
Findings become an actionable plan.
CCR groups findings into practical suggested timeframes so that organisations can focus on immediate priorities without losing sight of medium and longer-term improvements.
Highest-priority actions identified for early attention.
Near-term actions intended to strengthen the assessed posture.
Planned improvements after immediate priorities are addressed.
Longer-term improvements to keep visible in the security programme.
Designed to reference established cyber-security guidance.
CCR is designed so that relevant assessment controls can be mapped against established cyber-security guidance, including NIST CSF, CIS Controls and relevant Cyber Essentials control areas.
CCR is an independent assessment and improvement platform. References or mappings to third-party frameworks do not constitute certification, accreditation or endorsement by the referenced framework owners.
Decision support for cyber-security improvement.
- ✓A structured cyber-security assessment.
- ✓An evidence-aware view of assessed controls.
- ✓A way to identify and prioritise control gaps.
- ✓An improvement-planning tool.
- ✓A basis for reassessment and continuous improvement.
Assessment does not equal certification or guarantee.
- •Not a penetration test.
- •Not a formal security certification.
- •Not a guarantee that an organisation is secure.
- •Not a guarantee of regulatory compliance.
- •Not a replacement for specialist advice where deeper assurance is required.
An assessment is a point-in-time decision-support tool.
Quick Check results are based primarily on the information supplied during the assessment. Self-reported answers may not provide the same level of assurance as appropriate supporting evidence or expert review.
Cyber-security risk changes over time. Technology, people, suppliers, vulnerabilities and business processes can change, so periodic reassessment and improvement are important.
Understand your posture. Improve what matters first.
Start with the free CCR Quick Check and build a clearer picture of your organisation's cyber-security readiness.
Start Free Cyber Check →