Registers

The work behind the score.

Every register on the organisation home is a place to keep records, owners, and evidence. Filter them by the kind of work they hold.

13 registers

Estate

What the organisation depends on, and the outside parties that can affect it.

Systems, information, people, and facilities the organisation depends on.

Outside parties that store, process, or can affect that estate, and the assurance held for each.

What could go wrong, what is already exposed, and who can reach it.

Risks to the estate, the treatment chosen, and the owner accountable for it.

Known exposures and the fixes applied, with what is still outstanding.

Who has access to systems and information, and whether that access is still justified.

The rules the organisation has set, the controls that apply, and the people who must know them.

Policies the organisation has approved, who owns them, and when they were last confirmed.

Which controls apply, which do not, and the reason for each decision.

Obligations the security system has to meet, and the evidence that they are being met.

Who has completed the required training, and whose training is overdue.

Checks against the system, and the corrective work that follows a finding.

Planned audits, what was examined, and the findings that came back.

Where the system missed a requirement, and the corrective and preventive action that closes it.

Events that have already happened, and the plans for carrying on.

Security incidents, their impact, and how each one was contained and closed.

How critical activity continues through a disruption, and when that plan was last tested.

A walkthrough maps what you have onto this list and shows the effect on the readiness score.