Reality over compliance
The measure is whether the business can keep operating and recover, not whether a checklist looks complete.
The Cyber Readiness Method
One question,
answered honestly.
Could this business keep operating, recover, and prove what is in place? Everything in the Method exists to answer that.
Spend smarterFix the highest-impact gaps first.
Save timeSkip the research and guesswork.
Show your workBuild proof for customers, insurers, and leadership.
Not whether you own the right products. Not whether you would pass a checklist. Whether the protections that matter are really there, whether you could recover, and how much of that answer you can prove.
The questions a leader needs answered
Five questions. One credible picture.
Could an attacker get in, and how?
Through which realistic path, given how this business is actually set up.
What could they reach?
Where access could spread and what business operations depend on it.
Would we know?
Whether monitoring and response would surface the problem early enough to matter.
Could we recover?
Whether backups, recovery steps, people, and providers could restore operations.
How much can we prove?
Evidence separates a confident answer from a confident assumption.
The principles
How it reasons.
Evidence over assertion
Important claims are tested against evidence wherever evidence can exist.
Confidence is reported
An unverified answer is never presented with the authority of a fact.
Unknowns are findings
If nobody can determine whether a protection exists, that uncertainty matters.
Critical failures stand alone
One serious gap is not averaged away by a dozen strong answers.
Plain language, always
The person controlling the budget should understand what is at stake and what happens next.
Reported vs verified
The gap between them is the point.
Reported readiness
What you believe is in place.
Verified readiness
What the evidence supports.
When those are close, you have an accurate picture. When they diverge, you have found exactly the kind of assumption that causes expensive surprises.
What shapes your baseline
Fifteen areas, weighted by what changes outcomes.
Identity and access · Email · Endpoints and network · Backup and recovery · Data and cloud · Monitoring and detection · Incident response · Vendors · Assets · People and process · Physical operations · Application security · Organisational risk · Validation and improvement · Controlled unclassified information
Identity, backups, detection, and response carry more weight because they more directly determine whether a business can contain an incident and keep operating.
Recognized frameworks inform recommendations. Establishing your Cyber Readiness baseline is not a certification or compliance determination.
Boundaries
What the Method does not do.
Not a certification or proof of compliance.
Not a penetration test or vulnerability scan.
Not a legal opinion or insurance coverage determination.
Not a security guarantee. CRK cannot promise an attack will be prevented, that systems will be secure, or that a particular incident, compliance, insurance, or financial outcome will occur. Eligible first-year purchases are separately covered by the Cyber Readiness Results Guarantee, a refund promise tied to measurable readiness progress under its published terms.
It cannot verify what you cannot evidence.
See how it reasons.
Six questions. Two evidence uploads. About ten minutes.
Start your Cyber Readiness Checkup →Free. No credit card. No sales call.