PSYCHFLO · CYBERSECURITY ENTERPRISE

Know your gaps.
Plan your next 90 days.

Review your organisation’s security readiness, prioritise improvements and give each action an accountable owner. Built around your industry, from the first assessment to the next review.

Explore Cybersecurity Enterprise Pay by card

9 industry editions6 security functions30 / 60 / 90 day action plan

CHOOSE YOUR EDITION

Security in your context.

Each Cybersecurity Enterprise edition includes 13 core controls, six industry controls, 15 policy starters and a three-stage incident exercise. The earlier assessment remains available for existing work.

Industry edition

Cross-sector baseline

asset inventoryMFAbackupsincident responsesupplier risk

Assess readiness

Review controls across governance, identity, data, cloud, suppliers and incident response. Unknown answers remain visible as gaps.

Prioritise the work

Use weighted domain scores and a 90-day roadmap to agree actions, owners and evidence with your team.

Put it into practice

Download policy starters, assessment workbooks, risk and evidence registers, a board briefing and an incident exercise.

CUSTOMER ACCESS

Open your licensed workspace.

Enter your organisation and the access token issued after payment activation. Browse the controls and exercises freely; scoring, saved reviews and downloads require your purchased edition.

Organisation name

Licensed access tokenHeld only in this page’s memory. Keep your token securely.

CYBERSECURITY ENTERPRISE · INCLUDED WITH YOUR EDITION

A focused review. A rehearsed response.

Protect customer and business operations. Review 13 core controls and six controls for general business, then practise a three-stage incident exercise.

Framework context: NIST CSF 2.0. References describe conceptual alignment; validate the exact requirements for your organisation.

Asset inventoryMFA and privileged accessPatch managementBackup recoverySupplier assuranceIncident escalation

Use your licence token and organisation name above for scoring, saved reviews and downloads. Your earlier assessments remain available in the expandable section below.

General Business · Cybersecurity Enterprise review0 / 19 controls answered

Govern3 controls

CORE-001 · weight 3Risk governance

Maintain an approved risk appetite, decision rights and executive reporting

Evidence to collect: Risk committee minutes, approved policy and risk register

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-002 · weight 3Supplier assurance

Classify suppliers by criticality and assess their security

Evidence to collect: Vendor register, due diligence and contract clauses

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

GENERAL-001 · weight 5Asset inventory

Ensure asset inventory is governed, implemented, monitored and periodically tested for general business operations.

Evidence to collect: Approved asset inventory procedure, system configuration or register, owner sign-off, and dated test evidence

NIST CSF 2.0 (topic-level reference; applicability must be confirmed)

Identify3 controls

CORE-003 · weight 3Asset inventory

Maintain complete owners and criticality for systems and data

Evidence to collect: Reconciled CMDB, cloud inventory and owners

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-004 · weight 3Data classification

Identify sensitive information and retention obligations

Evidence to collect: Data map, classification and retention schedule

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

GENERAL-002 · weight 5MFA and privileged access

Ensure mfa and privileged access is governed, implemented, monitored and periodically tested for general business operations.

Evidence to collect: Approved mfa and privileged access procedure, system configuration or register, owner sign-off, and dated test evidence

NIST CSF 2.0 (topic-level reference; applicability must be confirmed)

Protect4 controls

CORE-005 · weight 4Identity and MFA

Apply phishing-resistant MFA to high-risk access and least privilege

Evidence to collect: IdP settings, access reviews and exception log

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-006 · weight 4Vulnerability management

Prioritise vulnerabilities by exploitability and business impact

Evidence to collect: Scanner reports, remediation tickets and exceptions

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-007 · weight 4Backup resilience

Maintain protected, recoverable backups with periodic restoration tests

Evidence to collect: Backup configurations, immutable copy evidence, restore logs

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

GENERAL-003 · weight 5Patch management

Ensure patch management is governed, implemented, monitored and periodically tested for general business operations.

Evidence to collect: Approved patch management procedure, system configuration or register, owner sign-off, and dated test evidence

NIST CSF 2.0 (topic-level reference; applicability must be confirmed)

Detect3 controls

CORE-008 · weight 3Security monitoring

Monitor critical assets with tested alert escalation

Evidence to collect: SIEM rules, alert runbooks and incident tickets

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-009 · weight 3Threat detection coverage

Measure logging completeness for critical systems

Evidence to collect: Log coverage matrix, retention policy and sample events

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

GENERAL-004 · weight 5Backup recovery

Ensure backup recovery is governed, implemented, monitored and periodically tested for general business operations.

Evidence to collect: Approved backup recovery procedure, system configuration or register, owner sign-off, and dated test evidence

NIST CSF 2.0 (topic-level reference; applicability must be confirmed)

Respond3 controls

CORE-010 · weight 4Incident command

Maintain decision authority, playbooks and external contacts

Evidence to collect: Incident plan, call tree and exercise record

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-011 · weight 4Communications and notification

Evaluate incident reporting duties and stakeholder messaging

Evidence to collect: Legal escalation matrix, approved communication templates

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

GENERAL-005 · weight 5Supplier assurance

Ensure supplier assurance is governed, implemented, monitored and periodically tested for general business operations.

Evidence to collect: Approved supplier assurance procedure, system configuration or register, owner sign-off, and dated test evidence

NIST CSF 2.0 (topic-level reference; applicability must be confirmed)

Recover3 controls

CORE-012 · weight 3Recovery priorities

Sequence restoration based on critical business services

Evidence to collect: Business impact analysis and dependency maps

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

CORE-013 · weight 3Lessons learned

Track corrective actions after exercises and incidents

Evidence to collect: After-action reports, owners and closure evidence

NIST CSF 2.0 (conceptual alignment; not an official crosswalk)

GENERAL-006 · weight 5Incident escalation

Ensure incident escalation is governed, implemented, monitored and periodically tested for general business operations.

Evidence to collect: Approved incident escalation procedure, system configuration or register, owner sign-off, and dated test evidence

NIST CSF 2.0 (topic-level reference; applicability must be confirmed)

Inside your Cybersecurity Enterprise download

15 editable policy starters, four CSV registers, the 19-control catalogue, framework notes and your industry exercise. Policy starters need tailoring, testing and approval.

INCIDENT TABLETOP

Business email compromise

Fictional educational tabletop exercise, not a documented real-world case study.

Stage 1: A credible alert indicates: Business email compromise. What is the first action?Confirm scope, protect safety, declare incident and preserve evidenceDelete all logs to save disk spaceNotify the public without validation

Stage 2: The disruption affects a critical supplier. Choose a resilience response.Wait indefinitely for supplier updatesActivate tested contingency workflows and track dependenciesDisable monitoring to improve performance

Stage 3: Services are restored. What next?Close the incident without reviewDestroy incident recordsValidate recovery, monitor recurrence and assign lessons learned

Use the exercise for team discussion; exercise results are not saved or used to calculate maturity.

Earlier assessment and saved work

YOUR READINESS WORKSPACE

Start with what you know.

Browse the controls freely. Scoring, saved assessments and downloads require an access token for your selected edition. Answers stay in this page until you choose to submit or save them.

General business0 / 48 controls answered

Governance & risk5 controls

G01Is there an approved information security policy reviewed at least annually?

G02Is there a documented security risk register with accountable owners?

G03Are security roles and escalation responsibilities formally assigned?

G04Is security awareness training completed and tracked annually?

GENERAL-EXT-01Are critical business assets inventoried and owned?

Asset management4 controls

A01Is there a maintained inventory of laptops, servers and mobile devices?

A02Is software inventory and approved software ownership maintained?

A03Are critical business services and dependencies documented?

GENERAL-EXT-06Has an incident tabletop been completed in the last year?

Identity & access6 controls

I01Is MFA enforced for privileged and remote access?

I02Are joiner, mover and leaver access changes approved and logged?

I03Are privileged accounts separate and subject to periodic review?

I04Are service accounts inventoried and secrets rotated securely?

GENERAL-EXT-02Is MFA enforced for privileged and remote access?

GENERAL-EXT-11Are critical security events centrally monitored?

Endpoint security4 controls

E01Are all managed endpoints protected by centrally monitored EDR/antimalware?

E02Are operating systems and browsers patched within defined SLAs?

E03Is full-disk encryption enforced for portable devices?

E04Are secure configuration baselines applied to endpoints?

Cloud & network security5 controls

C01Are cloud accounts configured with least privilege and logging?

C02Are internet-facing services inventoried and reviewed?

C03Are network boundaries and firewall rules reviewed periodically?

C04Are infrastructure secrets excluded from source code?

GENERAL-EXT-07Is staff security training relevant and measured?

Data protection6 controls

D01Is sensitive information classified and assigned owners?

D02Is sensitive data encrypted in transit and at rest?

D03Are retention and secure deletion requirements documented?

D04Are backup restorations tested at least quarterly for critical systems?

GENERAL-EXT-03Are critical vulnerabilities prioritised and tracked?

GENERAL-EXT-12Are critical service recovery targets agreed and tested?

Vulnerability management4 controls

V01Are authenticated vulnerability scans conducted regularly?

V02Are critical vulnerabilities remediated against defined deadlines?

V03Are external penetration tests commissioned after major changes?

GENERAL-EXT-09Are endpoints encrypted and centrally managed?

Monitoring & detection4 controls

M01Are security logs centralised with retention and access controls?

M02Are suspicious events triaged with named on-call ownership?

M03Are alerts tested to confirm they trigger and reach responders?

GENERAL-EXT-08Are sensitive datasets mapped and classified?

Incident response & resilience6 controls

R01Is there an approved incident response plan with escalation contacts?

R02Are tabletop incident exercises conducted at least annually?

R03Are recovery time and recovery point objectives defined?

R04Are immutable or isolated backups used for critical workloads?

GENERAL-EXT-04Are backups regularly restore-tested?

GENERAL-EXT-10Are privileged access rights periodically reviewed?

Third-party security4 controls

S01Are critical suppliers assessed for security before onboarding?

S02Are supplier contracts reviewed for breach notification obligations?

S03Are supplier access and dependencies reviewed annually?

GENERAL-EXT-05Are material suppliers assessed before onboarding?

Take your work with you.

Downloads require a verified licence. Templates need tailoring and review before use.

A self-reported readiness indicator. This toolkit does not provide penetration testing, independent assurance, certification or a legal compliance determination.