CSPM Readiness Scorecard
Score your cloud security posture in minutes. Answer a weighted questionnaire across the eight domains that CSPM tools evaluate — identity & access, data protection, network, logging & detection, vulnerability & patching, secrets, config/compliance and incident response — and get a transparent 0–100 posture score, a per-domain breakdown, and the prioritised gaps to fix first with concrete remediation. The weighting is shown in full; the tool runs entirely in your browser and never uploads anything.
Identity & Access · weight 18 / 100
Who can do what. Most cloud breaches trace back to an over-permissive or compromised identity, so this domain carries the most weight: enforce MFA, least privilege, and short-lived credentials over long-lived keys.
Multi-factor authentication is enforced for every human user, including the root / global-admin account — not merely available.
IAM policies follow least privilege — no wildcard "*" admin grants, no broad "Action: *" / "Resource: *" policies attached to everyday roles.
No long-lived static access keys — access is via short-lived role assumption, SSO, or federation, and any residual keys are rotated.
The root / owner account is locked down: no access keys, hardware or app MFA, and used only for the few tasks that require it.
Access is reviewed and recertified on a cadence, and unused identities, roles, and permissions are removed.
Data protection · weight 16 / 100
Encryption and exposure of the data itself. One publicly readable object store is a classic breach; this domain covers encryption at rest and in transit, public-storage checks, and key management.
Encryption at rest is enabled on object storage, databases, and volumes — not left to a per-resource opt-in that some resources miss.
Encryption in transit is enforced (TLS) for data moving between services and to clients; plaintext endpoints are disabled.
No object-storage bucket or blob container is publicly accessible unless it is an intentional, reviewed, and documented case.
Keys are managed in a KMS with controlled access and rotation, rather than ad-hoc keys embedded in applications.
Data is classified and backups are taken and test-restored, so sensitive data is both known and recoverable.
Network · weight 14 / 100
The reachable attack surface. Over-broad security groups and needless public exposure are where scanners find you first; flow logs give you the record of who talked to what.
Security groups / firewall rules are least-privilege — no 0.0.0.0/0 ingress to sensitive ports such as SSH (22), RDP (3389), or database ports.
Public exposure is minimised — workloads sit in private subnets, and public IPs / load balancers exist only where genuinely required.
Network flow logs are enabled and retained, so east-west and egress traffic can be reconstructed after the fact.
Environments and tiers are segmented, so a compromise in one does not grant flat network access to everything else.
Logging & detection · weight 14 / 100
Can you see it, and would you be told? A cloud audit trail (CloudTrail-type), a threat-detection service (GuardDuty-type), and centralised, tamper-resistant logs are what turn an incident from invisible into investigable.
A cloud audit trail (CloudTrail-type) records management-plane activity across all regions and accounts, not just one.
A managed threat-detection service (GuardDuty-type) is enabled and its findings are triaged, not ignored.
Logs are centralised / aggregated in a tamper-resistant store, separate from the accounts that generate them.
Log retention matches your incident-response and audit needs, rather than rolling off in hours or days.
Vulnerability & patching · weight 10 / 100
Known-bad software, found and fixed. Regular scanning and real patch SLAs keep the window between a public CVE and your exposure short.
Workloads and machine images are scanned for known vulnerabilities on a regular cadence.
Critical and high vulnerabilities have patch SLAs that are tracked and met — OS and dependency updates do not sit indefinitely.
Container images are scanned in the build pipeline so vulnerable images are caught before they ship, not in production.
Secrets management · weight 10 / 100
Credentials kept out of reach. Secrets belong in a managed vault with rotation and least-privilege access — not in code, env files, or repository history.
Secrets live in a managed secret store / vault — not hard-coded in source, baked into images, or sitting in committed env files.
Secrets are rotated on a schedule (or on suspicion of exposure) and access to each secret is least-privilege.
Repositories and CI are scanned for leaked secrets so an accidental commit is caught quickly.
Config & compliance · weight 10 / 100
Posture measured against a benchmark, and drift caught. CIS-benchmark coverage plus drift / config monitoring (CSPM-type) turn posture from a one-off audit into a continuous signal.
Your configuration is measured against a recognised benchmark (CIS or equivalent), so you know your coverage rather than guessing.
Configuration drift is detected continuously (a config / CSPM-type service), so a resource going non-compliant is noticed quickly.
Infrastructure-as-code is scanned before deploy, so misconfigurations are caught in the pipeline, not after they are live.
Incident response readiness · weight 8 / 100
What happens when something fires. A documented cloud IR plan, alerts that reach a human, and runbooks you have actually practised decide whether a detection becomes a contained incident or a slow-motion breach.
There is a documented incident-response plan that covers cloud-specific scenarios (key compromise, public exposure, account takeover).
Alerts are routed to an on-call path that a human sees and can act on — signal, not a noisy channel everyone mutes.
Runbooks and the IR plan are exercised (tabletops / drills), so the first time you run them is not during a real incident.
Educational self-assessment. The domain and item weights are PlayCISO's own transparent rubric for structured self-reflection — not a measurement, certification, or guarantee of outcome, and not based on any real-world average or benchmark figure. Answer options map to fixed values (None 0, Partial 0.34, Strong 0.67, Verified 1); each domain score is the weighted average of its items, and the overall score is the domain-weighted average, so answering every item "Verified" gives 100 and every item "None" gives 0. The tool performs no scan and makes no network calls — it runs entirely in your browser, and your answers only leave your device in the shareable link you choose to copy.
What this tool is
- A free, in-browser cloud security posture management (CSPM) readiness scorecard: answer a weighted questionnaire and get a 0–100 posture score with a per-domain breakdown.
- Covers the eight domains that decide cloud posture — Identity & Access, Data protection, Network, Logging & detection, Vulnerability & patching, Secrets management, Config & compliance, and Incident response readiness.
- Scoring is fully transparent: every domain and item weight is shown on the page, answers map to fixed values (None 0, Partial 0.34, Strong 0.67, Verified 1), and the overall score is the domain-weighted average.
- The output lists your prioritised gaps — highest-weight, lowest-scoring controls first — with concrete remediation and links to the matching PlayCISO tools (IAM, S3 bucket policy, security groups).
- Runs entirely in your browser with no scan and no network calls; download a Markdown or CSV summary, or copy a shareable link that reopens your exact answers.
What is CSPM, and what does this score?
Cloud security posture management (CSPM) is the ongoing work of finding and fixing misconfigurations and compliance drift across your cloud — public storage, over-permissive IAM, internet-facing security groups, unencrypted data, missing audit logs. Dedicated CSPM tools connect to your accounts and scan configuration against best-practice benchmarks like the CIS benchmarks. This scorecard is a fast, private, self-assessment version of the same idea: it asks you weighted questions across the domains a CSPM product evaluates and turns your answers into a posture score and a ranked fix list — without connecting to anything.
The eight posture domains
- Identity & Access (weight 18). MFA everywhere, least-privilege IAM, no long-lived access keys, a locked-down root account, and recurring access reviews. The single most common breach path, so it carries the most weight.
- Data protection (weight 16). Encryption at rest and in transit, no unintentionally public storage, managed keys, and tested backups.
- Network (weight 14). Least-privilege security groups, minimised public exposure, flow logs, and segmentation between tiers and environments.
- Logging & detection (weight 14). A CloudTrail-type audit trail, a GuardDuty-type threat-detection service, centralised tamper-resistant logs, and adequate retention.
- Vulnerability & patching (weight 10). Regular scanning, patch SLAs by severity, and image scanning in the build pipeline.
- Secrets management (weight 10). Secrets in a managed vault with rotation and least-privilege access, and secret scanning to catch leaks.
- Config & compliance (weight 10). CIS-benchmark coverage you can measure, continuous drift detection, and IaC scanning before deploy.
- Incident response readiness (weight 8). A documented cloud IR plan, alerts that reach an on-call human, and runbooks you have actually exercised.
How to read your score
Each answer maps to a fixed value — None 0, Partial 0.34, Strong 0.67, Verified 1 — and every item and domain weight is printed on the page. A domain score is the weighted average of its items; the overall score is the domain-weighted average, scaled to 0–100. The bands are this tool's own rubric, not an industry average: Exposed (0–39), Developing (40–64), Hardened (65–84) and Mature (85–100). Read the number as a prioritisation aid — the per-domain bars show where you are weakest, and the "Fix these first" list ranks gaps by weight and distance from done so you spend effort where it moves the score most.
This is a self-assessment, not a scan. It makes no network calls and reads nothing from your cloud — the score reflects the answers you give. For an authoritative picture, pair it with a real configuration review and the targeted PlayCISO auditors the gap list links to (IAM, S3 bucket policy, security groups). The weights are a transparent rubric for structured reflection, not a certification or a guarantee of outcome.
Frequently asked questions
What is cloud security posture management (CSPM)?
Cloud security posture management (CSPM) is the continuous practice of finding and fixing misconfigurations and compliance gaps across your cloud accounts — things like public storage buckets, over-permissive IAM roles, security groups open to the internet, unencrypted data, and missing audit logs. CSPM tools scan cloud configuration against best-practice benchmarks (such as the CIS benchmarks) and flag where you deviate. This scorecard is a lightweight, self-assessment version of that idea: instead of connecting to your cloud, it asks you weighted questions across the same domains a CSPM tool evaluates and turns your answers into a readiness score and a prioritised fix list.
How is the posture score calculated?
Each question is answered on a four-point scale that maps to a fixed value: None = 0, Partial = 0.34, Strong = 0.67, Verified = 1. Every question has a weight within its domain, and each of the eight domains has a weight that contributes to the overall score (the eight weights sum to 100). A domain score is the weighted average of its answered items, scaled to 0–100, and the overall score is the domain-weighted average of those. All of the weights are printed on the page, so the scoring is fully transparent — nothing is hidden. Because the mapping is monotonic, answering every item Verified gives 100 and every item None gives 0.
Is the score a benchmark against other companies or an industry average?
No. The score and the bands are PlayCISO’s own rubric — a transparent judgement framework for structured self-reflection, not a measurement against real-world data. There is no industry-average figure anywhere in this tool, and the per-domain bars compare your answers to a perfect score on this rubric, not to anyone else. Use it to see where your own posture is weakest and to prioritise remediation, not as a certification or a competitive benchmark.
Which cloud security domains does the scorecard cover?
Eight. Identity & Access (MFA, least privilege, no long-lived keys, root lockdown, access reviews); Data protection (encryption at rest and in transit, public-storage checks, key management, backups); Network (least-privilege security groups, minimised public exposure, flow logs, segmentation); Logging & detection (a CloudTrail-type audit trail, a GuardDuty-type threat-detection service, centralised tamper-resistant logs, retention); Vulnerability & patching; Secrets management; Config & compliance (CIS-benchmark coverage, drift detection, IaC scanning); and Incident response readiness. The highest-weighted domains are identity and data, because an over-permissive principal or one public data store is the most common path to a real cloud breach.
Does this tool connect to my cloud account or upload anything?
No. It performs no scan and makes no network calls at all — it is a questionnaire that runs entirely in your browser. Your answers stay on your device; the only way they leave is if you deliberately copy the shareable link (which encodes your answers in the URL) or download the Markdown or CSV summary. Because nothing is sent to a server, it is safe to fill in for a sensitive environment. For an actual configuration scan you would use a real CSPM product; this scorecard is for fast, private self-assessment and prioritisation.