DefendArm SecurityDefendArm SecurityKnow your risks. Protect what matters.
Self-assessment

Incident response readiness

Could your team contain a compromise and recover a critical service? Answer for the systems and tests you can verify today.

Incident ResponseReadiness

0 of 6 answered

1. Who can authorize isolation of a critical system outside business hours?

Check the on-call roster, delegated authority, and the last contact test.

2. Have responders tested disabling a compromised account and revoking its active sessions?

Use a test account in your identity provider and one critical SaaS service. Record what access survives.

3. Can responders preserve the evidence needed to investigate an incident?

Check access to identity, endpoint, cloud, and critical SaaS logs. Consider an unavailable administrator.

4. Has a critical service been restored without relying on the usual administrator account?

Use the most recent restore record, measured recovery time, and recovery credential procedure.

5. Can the team brief leadership and reach external incident contacts if corporate email is unavailable?

Check a recent exercise, alternate communications, and current legal, insurer, and provider contacts.

6. Did the last incident exercise lead to verified fixes?

Look for an exercise date, assigned findings, and evidence of retesting. A scheduled exercise is not a completed test.

How to read the score

Use the gaps to plan the next test.

This self-review is not an audit, certification, or estimate of breach probability. Each answer earns 0, 2, or 4 points; unknown answers earn no points and are counted separately. The indicator gives equal weight to each question. Critical gaps are flagged separately so other answers cannot hide them.

View all assessmentsOpen the assessment index
Current stateScore against how the environment works today

Answer for the state you can prove now, not the state you plan to have after a future project lands.

InterpretationResolve unknowns and critical gaps first

Missing evidence is a reason to investigate. Assign an owner to each action, agree a test, and record the result before changing the answer.

Follow-throughRetest after the control changes land

The point of the assessment is to give you a before-and-after view that shows whether the next round of work actually improved the risk.