Readiness Assessment · how to complete it

Your self-assessment, without the guesswork.

Your Readiness Assessment is built from your own answers — that's what makes it accurate to your business instead of a template with your logo on it. This page walks you through the worksheet: what each status really means, what to have in hand, and what happens after you send it back. Most businesses finish in 45–90 minutes.

The three steps

Download the worksheet from the private link in your purchase email. It's a spreadsheet with one row per requirement — your live score updates as you answer.
Mark a status for every row — Met, Partial, or Not Met — and jot a short note on how you meet it (the tool, policy, or practice). One honest sentence is plenty.
Reply to the same email with the completed file attached. Your report follows within one business day, after it clears our two-step accuracy check and a human review.

What each status actually means

MET

The control is in place, working, and applied consistently — and you could show someone if asked. Example: every account that can reach customer data requires multi-factor authentication, no exceptions.

PARTIAL

The control exists but isn't complete or consistent yet. Example: MFA is on for email but not for the VPN; backups run but you've never tested a restore. Note: on the DoD scoring scale, only two requirements earn partial credit — for every other row, Partial scores the same as Not Met. Mark it anyway: it's the truth, and your remediation plan will reflect the smaller step needed to finish.

NOT MET

The control isn't in place, or you're not sure it is. When in doubt, mark Not Met — an honest gap on the plan is worth more than a hopeful Met that an assessor later reverses.

Have these in hand before you start

Who has accounts on what — your list of users, admins, and shared logins.
How people sign in — where MFA is on, where it isn't, how passwords are managed.
Where your data lives — laptops, phones, cloud services, backups — and which of it is encrypted.
What watches your systems — antivirus, logging, alerts, whoever reads them.
Any written policies or plans you already have (incident response, acceptable use, SSP).

The rows people most often misread

Wireless access (3.1.16 / 3.1.17): this means your Wi-Fi — who's allowed on it and how it's secured. "The router came with a password" is a start, not a Met; if no one has ever reviewed it, say so.
Session lock and timeouts (3.1.10 / 3.1.11): screens that lock themselves and sessions that expire. Check your actual settings — don't answer from memory.
Audit logs (3.3.x): having logs isn't the same as keeping them, reviewing them, and being alerted when logging breaks. Answer each row on its own.
Media and USB drives (3.8.x): if there's no rule about thumb drives and old hard drives, those rows are Not Met — nearly everyone's are at first.
The System Security Plan (3.12.4): worth zero points but mandatory — without a written SSP the DoD methodology calls the whole assessment "not scorable." If you don't have one, that's your first remediation item, and our Template Pack includes one.

Answer what's true, not what sounds good. The score isn't a grade — it's a map. A 60 that's honest gives you a remediation plan that works and a number that climbs for real. A 95 that's hopeful falls apart the first time a customer, insurer, or assessor looks closely — and that moment is exactly what this report exists to prevent. Nobody sees your score but you.

What happens after you submit

Your answers run through the assessment engine, and the draft report then has to clear an automated integrity gate — seventeen checks that re-derive your score independently and verify every number in the document — followed by a human review. Only then is it released to you: a branded PDF with your readiness score, every gap ranked by point impact, and a phased remediation plan sequenced by return on effort. If anything in your answers doesn't add up, a real person contacts you before anything is generated from it.

A readiness assessment is a software-generated planning tool built from your self-reported answers — not an audit, not a certification, and not legal advice. Questions at any point: just reply to your purchase email, or write alerts@initialeyes.com.