Tools & Resources / Incident preparedness
Cyber Incident Response Preparedness Assessment Tool
A simple way to understand how well your organisation would respond to a cyber incident
Cyber incidents are no longer hypothetical. The real differentiator is how effectively an organisation responds when one happens—how quickly it gains clarity, how confidently it makes decisions, and how well it coordinates action across leadership, technology, legal, communications, and operations.
This free Cyber Incident Response Preparedness Assessment is designed to give you a realistic view of whether your organisation would stay in control during an incident, or lose time, momentum, and confidence at the point where outcomes are decided. It’s written in plain English so business stakeholders can complete it without needing to translate technical jargon into risk language.
Interactive / Self-assessment
Assess your incident response preparedness.
Who this assessment is for
This assessment is built for the people who have to make decisions when an incident is unfolding, not just the teams who investigate it. It is especially useful for boards and senior executives, business and risk leaders, CISOs and security leadership, incident response and resilience teams, and organisations preparing for tabletop exercises, audits, or regulatory scrutiny. You do not need deep technical expertise to complete it—just an honest view of how your organisation operates under pressure.
How the assessment works
The assessment takes around 10–15 minutes. You’ll answer a series of short, plain-English questions using a simple scale: No / Partly / Yes. When you finish, your results are generated instantly—there is no login requirement and no storage of your responses.
Your output is intentionally practical. You’ll receive an overall preparedness rating, a domain-by-domain breakdown across the six incident response capability areas, a clear indicator of your weakest points, and a downloadable, board-ready PDF report you can use for leadership discussions and improvement planning.
What you’ll get at the end
At completion you’ll receive a maturity verdict that reflects how your organisation is likely to perform in a real incident. The verdict ranges from Fragile (where a serious incident is likely to cause loss of control) through Reactive and Managed, to Resilient (where incidents are absorbed, handled in a controlled way, and used to improve capability over time).
Crucially, the assessment also highlights your lowest-scoring area. That’s deliberate: real incidents don’t fail at the average. They fail at the weakest link—unclear decision authority, poor coordination, untested recovery, ineffective communications, or slow detection.
Why this assessment is different
Most incident response “assessments” drift into tool inventories and technical checklists. They assume perfect execution and ignore the messy reality of incident management—leadership decision-making, communications pressure, legal obligations, competing priorities, and recovery constraints.
This assessment takes a more realistic approach. It reflects how incidents unfold in practice, focuses on coordination and judgement under pressure, aligns with recognised good practice, and is designed to be understood by non-technical leaders. It’s a starting point—not a formal audit—but it reliably shows where attention and investment will reduce risk most quickly.
Confidential by design
This tool is designed to be usable without friction and without creating data handling headaches. No login is required and results are not stored. If you export a report, you can watermark it for internal use or client delivery, and use it confidently in workshops, board discussions, and improvement planning.
Want help acting on the results?
Many organisations use this assessment as a baseline ahead of tabletop exercises, as preparation for board and risk committee discussions, or as a quick way to prioritise the first 90 days of incident response improvement. If you’d like help interpreting results, running exercises, or strengthening incident response capability in a pragmatic way, Cybersolace can support you with tailored guidance.