RiskCTRL2

Compliance Requirements

Select all that apply. This doesn't have to be perfect — you can refine it during the assessment or when reviewing insurer / contract language.

PCI DSSPayment Card Industry Data Security Standard — required for companies that process, store, or transmit credit card data.HIPAAHealth Insurance Portability and Accountability Act — for healthcare and anyone handling PHI.GDPRGeneral Data Protection Regulation — for organizations collecting or processing data from EU residents.SOC 2Service Organization Control 2 — common for SaaS and service providers.NIST 800-171 / CMMCFederal/CUI protections — for contractors handling Controlled Unclassified Information.FERPAFamily Educational Rights and Privacy Act — for schools handling student data.None / Not sureFor organizations without formal requirements or where you're still confirming with legal / compliance / insurer.

Other compliance notes (optional)

Current Security Stack (core)

All fields below are optional. Fill in what you know now — you can refine this later during the baseline assessment.

Identity & Access Security

Identity Provider (IdP)

MFA / Conditional Access

Password management

Network & Perimeter

DNS security / filtering

Remote access / VPN

Endpoint & Server

EDR / XDR (if separate from AV)

Patch management / RMM

Cloud Security

SaaS security / CASB / SSPM

Cloud email security add-ons

Data Protection

DLP

File storage / collaboration security

Monitoring & Response

SIEM / log aggregation

SOC / MDR provider

Vulnerability & Attack Surface

Vulnerability scanning

Attack surface management

Email + Web

Email auth / DMARC management

Web filtering / secure web gateway

Other Optional

MDM / UEM

Privileged Access Management (PAM)

Asset inventory / CMDB

Password rotation / local admin control

Add Client

Company Basics

Compliance Requirements

IT Environment

Current Security Stack (core)

Key Contacts