ORGSEC+ · Step 1 of 4
AssessAssess
The ORGSEC assessment gives an overall picture of how robust and secure the organisation actually is, across six dimensions, with a score per dimension.
In ORGSEC+Digital assessment and document upload in the browser · interviews and expert evaluation
After the assessment
Three questions management should be able to answer
After a completed ORGSEC assessment, management should be able to answer three questions.
- 1.How vulnerable are we?
- 2.Where are the most important weaknesses?
- 3.What should we do first?
One comprehensive assessment of the organisation's organisational security
Most organisations understand parts of their security. Few have a clear picture of the whole. Many start their security work with a risk analysis, a cyber analysis, an emergency plan or an exercise. ORGSEC starts one level higher, with an assessment of how the parts fit together, and of whether what the documents say reflects how the organisation will actually function when something happens.
The first question in the whole assessment is not whether you have an emergency plan, but what must continue to work. We start with the organisation's function: What do you deliver? Who depends on it? What must keep working even when the organisation is under significant pressure? How long can the function be unavailable? And which people, technologies, locations and suppliers do you depend on? The answers lead naturally to total defence, critical societal functions, security of supply and continuity.
Before the assessment starts, we send a standardised overview of the documentation we need, such as strategy, organisation chart, risk analyses, emergency and continuity plans, security policy, ISMS documentation, previous incidents, audits and exercise reports. We do not ask everyone for everything; the scope follows from what the organisation must be able to protect and maintain.
What we measure
Six areas, one overall picture
Each dimension carries a weight in the overall score and has five areas that are assessed separately. The assessment is not a questionnaire with hundreds of compliance questions, but an assessment of thirty clear organisational capabilities.
Example: preparedness and continuity scores lowest. That is where the plan begins.
- 01Security governance20 %
- 02Risk and threats15 %
- 03Preparedness and continuity20 %
- 04Cyber and technology15 %
- 05People and organisation15 %
- 06Crisis capability15 %
The process
How it is carried out in ORGSEC
The assessment follows the same sequence every time, so that the organisation is assessed against what security research shows makes organisations resilient – not against its industry – and so that progress can be followed over time.
- ORGSEC starts with what must continue to work, not with whether you have an emergency plan.
- A standardised start with all the information you need.
- Digital assessment, document analysis and interviews with key personnel.
- Expert evaluation of the key areas of organisational security.
- ORGSEC Score with the main findings and critical points.
- Prioritised measures for the next 3, 12 and 24 months.
ORGSEC Score
Each of the thirty areas is assessed on a maturity scale from 0 to 4. The scale is converted into an ORGSEC Score from 0 to 100, with a score per dimension and overall.
The total score must not overshadow serious individual findings. An organisation can score 78 overall and still lack the ability to handle a prolonged power outage or a cyber attack. Such findings are marked as Critical Findings, regardless of the total score.
- 0ExposedA critical capability is missing or unknown
- 1ReactiveThe work is mainly reactive and dependent on individuals
- 2EstablishedStructures and measures exist, but are not fully integrated or tested
- 3ManagedSystematic, anchored in management, documented and regularly tested
- 4ResilientIntegrated, tested, measured and continuously improved
No green self-reporting
The score is not based on a manager answering "yes, we have that". We triangulate: digital assessment, documentation, interviews, expert evaluation and testing. A manager may believe the crisis organisation works well, while the assessment shows otherwise.
Next to each score there is therefore a marker for how well it is evidenced: High, Medium or Low confidence. A score with high confidence has been verified through several sources. For the board and management it also shows what the organisation actually knows, and what it only believes it knows.
"We have a well-functioning crisis organisation."
- DocumentedYES
- Known in the organisationPARTLY
- Trained in the last 12 monthsNO
- Tested against a realistic scenarioNO
- EvaluatedNO
RESULT: 1.8 OF 4 · EVIDENCE: HIGH
| Area | Score | Evidence |
|---|---|---|
| Crisis organisation | 3.2 | High |
| Cyber recovery | 1.4 | High |
| Supply-chain resilience | 2.0 | Medium |
| Security culture | 2.6 | Medium |
| Geopolitical risk | 1.0 | Low |
The final report
Think of it as an MOT test for organisational security: standardised, repeated and easy to order. The methodology is ORGSEC's own, informed by recognised international standards, regulatory requirements and security best practice. The ORGSEC assessment is not a certification – it recommends, and the organisation decides what is implemented, and by whom.
What the first page of the report looks like · example
Established
- 6Critical Findings
- 11Priority Actions
- HighEvidence confidence
- Security governance72
- Risk and threats58
- Preparedness and continuity47
- Cyber and technology69
- People and organisation76
- Crisis capability51
