Truesec Apps FrameworkSample app

Security risk assessment

Score a system before an attacker does it for you.

Twelve questions across four domains. You get a weighted risk score, a per-domain breakdown and the findings to act on first.

12 questions~4 minutesNothing is saved — this demo runs in your browser

System under assessment

System or application

Responsible owner

Business criticality

01

Data & Exposure

What the system holds and who can reach it.

What is the most sensitive data the system processes?

Pick the highest classification, even if it is only a small part of the data.

Public or non-sensitive data onlyInternal business dataPersonal data (GDPR)Special category, financial or classified data

How is the system exposed to networks?

Internal network onlyInternet-facing behind VPN or zero-trust proxyInternet-facing with authenticationInternet-facing with anonymous access

How is data protected at rest and in transit?

Encrypted both at rest and in transit, keys managedEncrypted in transit, partially at restEncrypted in transit onlyNo consistent encryption

02

Identity & Access

How users and admins authenticate.

Is multi-factor authentication enforced?

Enforced for all users, phishing-resistantEnforced for all usersOnly for administratorsNot enforced

How are privileged accounts handled?

Just-in-time elevation with approval and loggingSeparate admin accounts, reviewed regularlySeparate admin accounts, rarely reviewedShared or permanent admin accounts

How often are user permissions reviewed?

Automated, continuous reviewAt least quarterlyAnnuallyNever or ad hoc

03

Resilience & Response

Backups, logging and incident readiness.

What is the backup and restore situation?

Immutable backups, restore tested within 12 monthsRegular backups, restore tested occasionallyBackups exist, restore never testedNo backups

Are security-relevant events logged and monitored?

Centralised logging with 24/7 monitoring and alertingCentralised logging, reviewed during office hoursLogs exist locally, no monitoringNo meaningful logging

Is there a tested incident response plan for this system?

Documented plan, exercised in the last yearDocumented plan, not exercisedInformal plan onlyNo plan

04

Supply Chain

Vendors, dependencies and third-party access.

How is the vendor or supplier assessed?

Security assessed, contract with security termsSecurity questionnaire completedVendor known, no security assessmentNo assessment, or vendor unknown

How quickly are critical vulnerabilities patched?

Within days, automated pipelineWithin a monthWithin a quarterUnpatched or unknown

Do third parties have access to the system or its data?

No third-party accessLimited, time-bound and monitored accessStanding access for named third partiesBroad or unmonitored third-party access

0 of 12 answered

Sample application for the Truesec Apps Framework. Answers stay in your browser and are never sent anywhere.