People readiness · about 5 to 7 minutes

Security culture & role readiness

Measure whether people can make the needed decision. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original people-readiness prompts. Not an employee-performance rating, psychometric measure, certification or proof of reduced incident likelihood. Reference: NIST security awareness guidance (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Roles

Do people know the security decisions expected in their role?
Can managers explain who accepts risk and exceptions?
Are security responsibilities included when roles change?

Learning

Does training use scenarios people actually encounter?
Can participants explain why an answer is safer?
Are accessibility, language and time constraints addressed?

Practice

Do teams rehearse ambiguous situations without harming real systems?
Are technical and executive decisions exercised together?
Does each exercise end with owned improvements?

Feedback

Can people report mistakes and suspicious activity without fear or delay?
Are training needs informed by incidents and control changes?
Is programme success measured beyond attendance and clicks?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the Security culture & role readiness assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · Cloud & identity · AI & agent security · SOC & incident readiness · Small business security · Web & API release readiness · Supplier security review · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations