A practical starting point.
A transparent score.
Understand your organization’s cybersecurity practices through a structured, business-friendly evaluation.
Designed around everyday security
ExquiseIT evaluates commonly recognized security principles and industry guidance: access control, protecting devices and data, maintaining systems, and preparing to respond. It is designed for small and midsize businesses, typically with 10–250 employees, without a large security team. It does not certify compliance with any framework or regulation.
What to expect
Allow about 15–20 minutes for 48 core questions. Cloud infrastructure adds five questions, internal software development adds seven, and payment card processing adds three. You can review every answer before calculating your results. Select “Unsure” when a practice needs confirmation; select “Not Applicable” only when the control truly does not apply.
How scoring works
Yes earns 100%, Partially 50%, No 0%, and Unsure 25%. Not Applicable is excluded from the calculation. Each question has a weight from 2 to 5 reflecting its relative importance. Within a domain, we divide the sum of weighted answer values by the sum of applicable question weights.
| Domain | Weight |
|---|---|
| Identity & Access Management | 20% |
| Endpoint Security | 15% |
| Email & Collaboration Security | 10% |
| Data Protection & Backup | 15% |
| Vulnerability & Patch Management | 15% |
| Network & Cloud Security | 10% |
| Incident Response | 10% |
| Security Governance & Awareness | 5% |
The overall score is the weighted average of the unrounded domain scores, rounded to the nearest whole number. A domain containing only N/A answers is excluded and the remaining domain weights are proportionally normalized. If every domain is excluded, the assessment is “Not scored.” High exclusion counts reduce the breadth of the result and are shown alongside the score.
Cloud questions contribute to Network & Cloud Security, application questions to Vulnerability & Patch Management, and payment questions to Data Protection & Backup. Their individual weights join the other questions within that domain; the eight domain weights stay unchanged.
Readiness classifications
Classifications use the displayed, rounded overall score. They are indicators of reported readiness, not predictions of a breach or guarantees of security.
Critical controls and priorities
Critical controls include administrative MFA, protected and tested backups, endpoint protection, patching, and incident response. A “No” answer creates a High finding; “Partially” or “Unsure” creates a Medium finding. These findings do not change the score beyond the documented weighted calculation.
Key strengths show up to three highest-scoring domains at 75 or above. Priority areas show up to three lowest-scoring domains below 100. Recommendations prioritize critical controls, then lower answer values, then higher question weights, with question IDs breaking ties. A low score is a starting point for improvement, not a judgment.
Your information stays with you
The questionnaire calculates results on your device and stores progress in your browser. Avoid shared devices and do not enter confidential information. Read the privacy notice.
Start Free Assessment