Tools · Security Policy Management
Which security policies are we missing?
Choose your profile, then check each policy topic it needs: is there a document, approved at the right tier, in date, acknowledged and not duplicated? You get a word for each topic and the actions in the order to take them. Free, no account, and nothing is stored.
Question 1 of 5
Part 1 of 4
About your organisation
These decide which questions apply to you.
About your organisation
Core topics
Nothing to answer in this part, from your earlier answers.
- PT-01 Choose your profile first.
- PT-02 Choose your profile first.
- PT-03 Choose your profile first.
- PT-04 Choose your profile first.
- PT-05 Choose your profile first.
- PT-06 Choose your profile first.
- PT-07 Choose your profile first.
Growing topics
Nothing to answer in this part, from your earlier answers.
- PT-08 Choose your profile first.
- PT-09 Choose your profile first.
- PT-10 Choose your profile first.
- PT-11 Choose your profile first.
- PT-12 Choose your profile first.
- PT-13 Choose your profile first.
- PT-14 Choose your profile first.
- PT-15 Choose your profile first.
Regulated topics
Nothing to answer in this part, from your earlier answers.
- PT-16 Choose your profile first.
- PT-17 Choose your profile first.
- PT-18 Choose your profile first.
You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.
- About 20 minutes
- Nothing is stored, not even in your browser: reloading starts again
- If you accepted analytics, we count how far people get through the questions, never what they answer.
- Also as a workbook: Policy Coverage Gap Assessment
How this is worked out, and what it is not
- Results. Not required: your profile does not need the topic. Missing: no document. Duplicated: two documents overlap (fix this first for the topic, even if other checks fail). Needs work: covers only part of the topic, or one check fails. Covered: a document exists, at the right tier, in date, acknowledged where required and not duplicated. Not answered: a question on a required topic is blank.
- Missing documents come first, because a topic with no document has no rule at all: Core topics, then Regulated topics (a legal obligation for regulated entities), then Growing topics.
- Then documents that need work or are duplicated, in the same order: Core, Regulated, Growing.
- Within each group, topics keep their order in the list (PT-01 first).
Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.
- This assesses whether the right documents exist and are governed, not whether what they say is good or whether people follow them. A topic can be Covered by a weak policy. Test what the documents say against the Security Policy Document Template, and whether they are followed through audit and the effectiveness assessment (PT-18).