Assessment: articles and guides

A SOC maturity model scores how developed your security operations are. The levels, the dimensions to assess, SOC-CMM and how to build a roadmap.

A practical vendor security assessment checklist: the areas to review before onboarding a third party, the evidence to ask for, and how to rank vendors by risk instead of treating them all the same.

Security questionnaires are the backbone of third-party risk management — when they are focused. What to include, how to avoid questionnaire fatigue, and how to turn answers into decisions.

A PCI DSS gap analysis compares your current controls against the standard's requirements before a formal assessment. How to scope it, run it, and turn the findings into a remediation plan.

NIST CSF 2.0 defines four maturity tiers — Partial, Risk-Informed, Repeatable, Adaptive. What each tier means and how to run a maturity assessment.

A vendor-neutral ransomware readiness assessment: the controls that actually decide whether an incident is a bad day or a business-ending one, grouped so you can score yourself and find the gaps.

Cyber readiness assessment tools compared for 2026: free self-assessments (CISA CSET, CISA Cyber Resilience Review, NIST CSF 2.0 resources, PlayCISO scorecards), open-source GRC (SimpleRisk, eramba) and commercial platforms (Vanta, Drata, Cyberbit, Immersive), with prices as of October 2026.