Welcome
How Business Aligned Are You?
Take this assessment to gauge your organization's ability to answer “How secure are we?” and understand how well aligned your security practices are to your business goals.
The assessment will yield customized results and recommendations and should take no more than 5 minutes to complete.
Note: A form completion is required to view your custom results and receive a PDF with your responses. Your responses will not be stored in a database tied to any personally identifiable information.
Questions
Please rate your organization's cybersecurity strategy using a five-point scale, where 5 is “completely describes my organization” and 1 is “does not describe my organization at all.”
1 - Does not describe my organization at all
2 - Somewhat describes my organization
3 - Neutral
4 - Mostly describes my organization
5 - Completely describes my organization
There is a formal cybersecurity strategy, developed and implemented to support organizational strategy, with defined metrics to track and improve business alignment.
The security function can clearly demonstrate its ability to help the organization successfully win, serve, and retain customers.
Security leaders are involved with helping inform, set, and make decisions related to the organization's business strategies.
Our cybersecurity strategy is largely reactive and focused on solving the problem of the day, rather than predictive or forward-looking.
1 of 6
Questions
2. Please rate your organization's security governance and program management using a five-point scale, where 5 is “completely describes my organization” and 1 is “does not describe my organization at all.”
1 - Does not describe my organization at all
2 - Somewhat describes my organization
3 - Neutral
4 - Mostly describes my organization
5 - Completely describes my organization
The security organization has metrics in place to track cybersecurity return on investment and impact on business performance.
There is a defined benchmarking process that clearly articulates expectations and demonstrates continuous process improvement relative to peer companies and/or internal groups
The security organization frequently collaborates with business and IT counterparts to capitalize on opportunities to improve security and protect against emerging risks.
The organization uses quantifiable analysis of risks to support definitive prioritization and cost justification of mitigation efforts.
The decision of whether and when to address a risk is based on maximizing business outcomes within defined risk threshold.
2 of 6
Questions
3. Please rate your organization's technology approach to vulnerability management using a five-point scale, where 5 is “completely describes my organization” and 1 is “does not describe my organization at all”
1 - Does not describe my organization at all
2 - Somewhat describes my organization
3 - Neutral
4 - Mostly describes my organization
5 - Completely describes my organization
Automated assessments are utilized, with measurements in place to identify gaps in coverage that are addressed when identified.
The organization has established key risk and performance metrics to maximize the business access to relevant data while mitigating risk.
The security organization primarily uses manual reviews of spreadsheets to track its cybersecurity performance.
The security organization has a holistic understanding and assessment of the organization's entire attack surface.
The security organization has good visibility into the state of security of our organization's most critical assets, including IT, OT, and IoT
3 of 6
Questions
4. Please rate your organization's threat and vulnerability assessment using a five-point scale, where 5 is “does not describe my organization at all.”
1 – Does not describe my organization at all
2 – Somewhat describes my organization
3 - Neutral
4 – Mostly describes my organization
5 – Completely describes my organization
The organization uses a risk-based approach to prioritize and justify mitigation efforts according to business needs and risk management objectives.
The monitoring and incorporation of threat intelligence for the likelihood of exploitation as well as asset value is automated.
The organization utilizes a combination of asset criticality and vulnerability criticality when prioritizing remediation efforts.
Automated processes exist for applying business risk management objectives to vulnerability prioritization practices.
Vulnerability assessments are conducted on a frequent basis using automated tools.
4 of 6
Questions
5. Please rate your organization’s security operations using a five-point scale, where 5 is “completely describes my organization” and 1 is “does not describe my organization at all.”
1 – Does not describe my organization at all
2 – Somewhat describes my organization
3 - Neutral
4 – Mostly describes my organization
5 – Completely describes my organization
The security organization closely tracks its performance, costs, and risk management efforts.
The security organization regularly reviews its performance metrics with business stakeholders.
The security organization works with business stakeholders to align cost, performance, and risk reduction objectives with business needs.
5 of 6
Questions
6. Please rate your organization’s business relationship where 5 is “completely describes my organization” and 1 is “does not describe my organization at all.”
1 – Does not describe my organization at all
2 – Somewhat describes my organization
3 - Neutral
4 – Mostly describes my organization
5 – Completely describes my organization
IT operations and the security organization are closely aligned to ensure that the vulnerabilities that pose the greatest risk to the business are remediated quickly and effectively.
Cybersecurity initiatives are closely aligned with business priorities
Cybersecurity is discussed at all levels of management and is seen as critical to organizational success.
There is formal and ongoing cross-functional collaboration on projects and initiatives with an eye toward improving both security and business performance.
6 of 6
Results Overview
Thank you for taking the assessment. Based on your responses, here is a sneak peek at how aligned your security practices are to your business goals.
Chart Placeholder
Your maturity result:
To view your customized and detailed results register below.
COOKIE ACCEPTANCE IS REQUIRED TO SEE PERSONALIZED RESULTS
View your detailed results
Please tell us a little bit about yourself.
Recommendations
Your score means your cybersecurity and risk assessment strategy is primarily siloed.
- Your cybersecurity strategy is largely reactive and focused on solving the latest problems. Your security goals are not aligned with business goals, and you are not tracking business risk metrics/benchmarking or performing quantifiable analysis to determine ROI on security investments.
- Your security organization does not closely track performance, cost, and risk management efforts. It fails to work with business stakeholders to regularly review performance metrics or to align risk objectives and cost with business needs. There is no cross-functional collaboration or alignment of priorities and performance.
- Your organization doesn’t use a risk-based approach to prioritize and justify mitigation efforts. Vulnerability assessments and business risk management objectives are not automated. Monitoring threat intelligence for the likelihood of exploitation is largely manual.
- Your security organization does not have holistic visibility into your entire attack surface. Your organization does not use automated assessments to identify gaps in coverage, and tracking cybersecurity performance is done through manual reviews of spreadsheets.
4 Steps You Can Take Today To Improve Your Business Alignment
If you're early in maturing your vulnerability management (VM) program and becoming business aligned, there are four steps you can take to uncover what matters most to the business and attain more complete visibility into those systems:
- Understand your business environment and set KPI baselines. It’s essential to identify and prioritize business-critical services and applications, identify service and application owners and other stakeholders, and establish and evaluate existing security and applicable IT policies and processes.
- Define architecture, integration, and deployment plan. You’ll need to create a sensor deployment strategy to ensure that your VM program doesn’t have any blind spots. This means that, in addition to using a network scanner, you may need passive monitoring agents, cloud connectors, and agent-based sensors. Obtaining buy-in from the rest of the organization is essential at this point.
- Discover and map assets. Identify all subnets throughout your environment and develop a scan strategy to discover all assets located within those subnets. Establish scan policies and profiles for each, based on agreements made with individual owners and stakeholders.
- Scan all discovered assets for vulns. Perform authenticated scans, whenever possible, for all known assets across your entire attack surface, including transient assets. It’s essential that you perform continuous assessments of all known assets and dynamically discover new assets the moment they join the network.
Your score means your cybersecurity strategy is moderately aligned to the business strategy.
- Your cybersecurity strategy and goals take prioritization into account, but they are not closely aligned to business objectives. Metrics are collected and reviewed, but not evaluated in context to business risk.
- Your security organization tracks performance, cost, and risk management efforts but only does so irregularly. The ad hoc nature of reviews creates gaps when resources are constrained. Your organization fails to work with business stakeholders to regularly review performance metrics or to align risk objectives and cost with business needs. There is limited cross-functional collaboration or alignment of priorities and performance.
- Your organization does not consistently apply a business risk-based approach to mitigation efforts. Vulnerability assessments, business risk management review, and the monitoring of threat intelligence for targeted exploit likelihood are infrequent, ad hoc, or largely manual.
- Your security organization has an incomplete understanding of its attack surface. Your organization has established some risk and performance metrics to make relevant data available to the business. Your organization does not use automated assessments to identify gaps in coverage, and cybersecurity performance is tracked primarily through manual reviews of spreadsheets.
4 Steps You Can Take Today To Improve Your Business Alignment
- Understand your business environment. It’s essential to identify and prioritize business-critical services and applications, identify service and application owners and other stakeholders, and establish and evaluate existing security and applicable IT policies and processes.
- Continuously assess all your assets. All too commonly, assessment plans call for monthly scans — sometimes even less frequently. But if you don’t perform assessments frequently enough, you’ll be basing your remediation decisions on old, outdated information. It’s essential that you perform continuous assessments of all known assets and dynamically discover new assets the moment they join the network.
- Add business context by tagging assets with descriptive metadata. Use tags to identify business-critical assets. Tagging allows you to measure risk by business entity (what “job” do these assets support?) or by team (who do I need to work with to remediate potential issues?). With Tenable, you can tag assets both automatically (using rules) and manually.
- Prioritize vulnerabilities based on risk and determine action. To effectively prioritize the vulnerabilities that pose the most risk, you need to understand the full context of each vulnerability. This requires detailed information about the vulnerability, threat and exploit intelligence, criticality of affected assets, and predictive technology to determine likely future attacker activity. Then, take the appropriate action to effectively manage the risk based on what you previously determined during the initial discover phase, as you developed a comprehensive understanding of your environment.
Congratulations, your score means that your cybersecurity strategy is well-aligned to the business.
- Your organization has a formal cybersecurity strategy that is aligned to the business’s objectives. You keep your program aligned by regularly collecting and reviewing the business-aligned metrics/benchmarking to continually improve. You perform quantifiable analysis to determine ROI on security investments.
- You regularly work with business stakeholders to align risk objectives and cost with business needs. There is cross-functional collaboration and alignment of priorities and performance. You closely track performance, cost, and risk management efforts.
- You use a risk-based approach to prioritize and justify mitigation efforts. Vulnerability assessments and business risk management objectives are automated and varied. You automate the monitoring of threat intelligence for the likelihood of exploitation.
- Your security organization has a holistic understanding of your entire attack surface. Your organization uses automated assessments to identify gaps in coverage, and tracking cybersecurity performance is not done through manual reviews of spreadsheets.
4 Steps You Can Take Today To Improve Your Business Alignment
- Take your vulnerability management program to the next level. Strive to maximize your efficiency by tracking and benchmarking your business process integrity metrics internally, as well as against industry peers. This includes remediation maturity, which measures your speed and efficiency, and assessment maturity, which quantifies how well you’re scanning your environment
- Gain a comprehensive understanding of your attack surface. This includes operational technology (OT) and cloud assets, as well as web apps. Employ machine learning technologies to accurately prioritize the remediation of assets that have yet to receive an authenticated scan.
- Perform periodic reviews of the entire plan. Once you’re aligned with the business, it’s important for security and business leaders to regularly meet to ensure the teams remain aligned and to benchmark progress against internal and industry peer metrics.
- Gamify risk reduction. There’s always room for improvement, even on the best teams. Holding contests to see which team can reduce the most risk — whether for prizes or for bragging rights — boosts morale, inspires teams to strive for more, and increases camaraderie.
Next Steps
Read the research
Thank you for taking the time to complete this assessment. Read the full Forrester report commissioned by Tenable.
Ready to get started?
To learn more about how Tenable can help you build and refine your security practices, visit https://www.tenable.com/solutions/vulnerability-management
Methodology
Methodology, Disclaimers and Disclosures
Methodology
Methodology
In April 2020, Tenable commissioned Forrester Consulting to conduct an online survey of 416 security and 425 business executives to examine cybersecurity strategies and practices at midsize and large enterprises.
Disclaimer
Although great care has been taken to ensure the accuracy and completeness of this assessment, Tenable and Forrester are unable to accept any legal responsibility for any actions taken on the basis of the information contained herein.
Required Inputs
Please enter an answer for all of the fields on this screen before continuing to the next.
Close
Choose your country
x