Security Self-Assessment Questionnaire: How to Structure Yours
A security self-assessment questionnaire turns "how secure are we?" from a gut feeling into measurable data. It's the same questionnaire concept customers use on vendors — pointed at yourself, with scoring attached. Here's how to build one that people actually complete.
Five Rules for a Useful Self-Assessment
Pick your framework anchor
Free-form question lists miss things. Anchor to ISO/IEC 27001:2022 Annex A (organizational ISMS), CSA CAIQ (cloud service controls), or both — so coverage is provable.
Score answers, don't just collect them
Yes/no hides partial work. Use a maturity scale (e.g., fully / mostly / partially / planned / not implemented) so half-done controls get credit and visibility.
Weight by importance
Not every control moves risk equally. Weighting makes “no MFA anywhere” count more than “clean desk policy needs refresh”.
Aggregate into domain scores
Roll control scores up into domains and an overall score so leadership sees trends, not a 200-row spreadsheet.
Turn gaps into tasks
Each gap should produce a concrete remediation item: what to fix, suggested approach, rough effort. Otherwise the exercise changes nothing.
What Good Questions Look Like
Weak questions invite useless answers:
×"Is security important to you?" — everyone says yes.
×"Do you do access control?" — ambiguous; nobody scores the same way.
Strong questions are specific and verifiable:
“Is multi-factor authentication enforced for all administrative accounts?”
“Are access rights to production data reviewed at least quarterly, with evidence of the last review?”
“Customer data is encrypted at rest using which of the following…”
This is exactly why frameworks exist: ISO 27001's Annex A and the CSA CAIQ contain hundreds of pre-written, battle-tested questions. Adopting them beats writing your own.
Or Skip Building One — Use Ours
EvaluationCat implements this entire pattern for you: the full ISO/IEC 27001:2022 control set as a structured questionnaire, five-level maturity scoring with importance weighting, domain-level aggregation, and gap-to-task remediation output. Free to run, progress saves automatically, and you can export a report when you're done.
Run the Questionnaire Online, Free
93 controls · weighted scoring · instant results