AI-Powered Security Assessment
Answer scenario-based questions to discover which compliance frameworks your organisation needs, identify critical gaps, and get a prioritised roadmap — completely free.
18
Questions
7
Phases
20+
Frameworks
5 min
To Complete
Phase 1: Regulatory Context
1 of 30
Where is your organisation primarily based?
Your jurisdiction determines which regulatory frameworks are mandatory vs. voluntary.
Phase 1: Regulatory Context
2 of 30
Which industry best describes your organisation?
Why this matters: Different industries have sector-specific regulations that mandate certain security frameworks. A hospital must comply with health data laws, while a bank faces prudential standards — choosing the wrong framework wastes time and budget.
Phase 1: Regulatory Context
3 of 30
Does your organisation handle government data or hold government contracts?
Scenario: Your company wins a contract to build software for a federal agency. The contract requires you to handle PROTECTED-level data. You now need an IRAP assessment at PROTECTED level before you can access any government systems. Without it, the contract cannot proceed.
Phase 1: Regulatory Context
4 of 30
What types of sensitive data does your organisation process?
Select ALL that apply. Each data type triggers specific regulatory requirements.
Select all that apply
Phase 1: Data Privacy & Consent
5 of 30
How does your organisation manage data privacy obligations?
Scenario: A customer exercises their “right to be forgotten” under GDPR. Your team needs to locate every system that holds this person’s data, verify deletion, and provide evidence within 30 days. Without a privacy governance framework, this becomes a panicked, manual scramble across 20 systems — with no audit trail proving you complied.
Phase 1: Data Privacy & Consent
6 of 30
How do you manage user consent for data collection and processing?
Scenario: Your marketing team wants to email 50,000 customers about a new product. Legal asks: “Can you prove each person consented to marketing communications? Can you show when they consented, what they consented to, and whether any have withdrawn?” If your answer involves a spreadsheet, you have a consent management gap.
Phase 1: Data Privacy & Consent
7 of 30
Does your organisation transfer personal data across national borders?
Scenario: Your Australian company uses AWS US-East for hosting, Google Workspace (US-based), and a Philippines-based BPO for customer support. Under the Australian Privacy Act APP 8, you must ensure overseas recipients comply with the APPs. Under GDPR, transfers outside the EU require Standard Contractual Clauses. Violations carry fines up to 4% of global turnover.
Phase 2: Threat & Risk Landscape
8 of 30
How many employees and managed identities does your organisation have?
Why this matters: An organisation with 50 employees managing 200 cloud accounts has fundamentally different identity governance needs than one with 20,000 employees across 15 countries. The scale determines whether manual processes will work or if you need automated lifecycle management.
Phase 2: Threat & Risk Landscape
9 of 30
Has your organisation experienced a security incident in the last 24 months?
Scenario: After a phishing attack compromised an executive’s email, the attacker used their credentials to access the finance system and initiate fraudulent wire transfers. The board now demands a full security assessment and evidence that controls are in place to prevent recurrence.
Phase 2: Threat & Risk Landscape
10 of 30
Do your clients or partners require you to demonstrate compliance?
Scenario: A Fortune 500 prospect sends you a vendor security questionnaire. They require a SOC 2 Type II report before they’ll sign the contract. Your competitor already has one. Without it, you lose the deal worth $2M annually.
Phase 2: Threat & Risk Landscape
11 of 30
How many third-party SaaS applications and vendors have access to your data?
Why this matters: The MOVEit breach (2023) and Optus breach (2022) demonstrated how third-party supply chain risk can be catastrophic. Each vendor with access to your data is a potential attack vector that needs governance.
Phase 3: Current Security Posture
12 of 30
How do you currently manage user access and identity lifecycle?
Scenario: An employee resigned last Friday. On Monday, their Active Directory account is still active, their Jira access is unchanged, and their GitHub repos still have their SSH keys. HR sent an email to IT, but nobody actioned it yet. Sound familiar?
Phase 3: Current Security Posture
13 of 30
What is your infrastructure and cloud environment?
This determines your attack surface and which cloud security frameworks apply.
Phase 3: Current Security Posture
14 of 30
Which security controls do you currently have in place?
Select ALL that apply. This helps us identify gaps against recommended frameworks.
Select all that apply
Phase 3: Current Security Posture
15 of 30
What keeps you up at night? Select your top identity security concern.
Scenario: Your CISO presents to the board. The first question is: “Can you tell me exactly who has access to our crown jewels right now?” If you can’t answer confidently in under 60 seconds, you have an identity governance problem.
Phase 4: Readiness & Priorities
16 of 30
Are any of these sector-specific regulations applicable to you?
Select ALL that apply. These trigger mandatory framework requirements.
Select all that apply
Phase 4: Readiness & Priorities
17 of 30
What is your approximate annual budget for security and compliance tooling?
Context: The average mid-market Australian company spends 5–8% of IT budget on cybersecurity. Legacy IGA platforms (e.g., on-premise solutions) typically cost A$80K–250K/year. Activitee delivers equivalent capability from A$8K/year.
Phase 4: Readiness & Priorities
18 of 30
What is driving the urgency for this assessment?
Understanding your timeline helps us prioritise recommendations.
Phase 5: AI Governance
19 of 30
Does your organisation develop, deploy, or use AI/ML systems?
AI governance requirements are expanding rapidly. The EU AI Act, NIST AI RMF, and ISO 42001 all impose obligations on AI system operators.
Phase 5: AI Governance
20 of 30
What AI governance controls do you have in place?
Select all that apply. These map to ISO 42001, NIST AI RMF, and EU AI Act requirements.
Phase 5: AI Governance
21 of 30
What is the risk profile of your AI systems?
The EU AI Act classifies AI systems by risk level. Higher-risk systems face stricter obligations.
Phase 5: AI Governance
22 of 30
How do you manage AI-related identity and access security?
AI systems introduce unique IAM challenges: service accounts, API keys, model access, and automated decision-making authority.
Phase 6: Infrastructure & Operations
23 of 30
Does your organisation operate, own, or host services in data centres?
Why this matters: Data centre operators face specific compliance requirements for physical infrastructure, power resilience, cooling, and physical security that go beyond standard cybersecurity frameworks.
Phase 6: Infrastructure & Operations
24 of 30
What availability and resilience level does your infrastructure require?
Context: Uptime Institute Tier III (99.982%) allows concurrent maintenance without downtime. Tier IV (99.995%) is fault-tolerant — any single failure has zero impact. Most enterprise workloads need Tier III; financial and government need Tier IV.
Phase 6: Infrastructure & Operations
25 of 30
Does your organisation operate critical infrastructure or industrial control systems?
Context: Under Australia's SOCI Act 2018, critical infrastructure spans 11 sectors including data storage/processing, telecommunications, energy, water, healthcare, and financial services. SOCI-regulated entities must implement a Critical Infrastructure Risk Management Program (CIRMP).
Select all that apply
Phase 6: Infrastructure & Operations
26 of 30
Does your organisation have energy efficiency or sustainability reporting obligations?
Select ALL that apply. These determine whether energy and environmental frameworks are recommended.
Select all that apply
Phase 7: DC Governance & Data Sovereignty
27 of 30
What physical security and environmental controls does your data centre have?
Why this matters: TIA-942, EN 50600, and Uptime Institute standards mandate specific physical security (mantrap, biometrics, CCTV) and environmental controls (HVAC redundancy, fire suppression, flood protection). These are auditable and affect your tier classification.
Phase 7: DC Governance & Data Sovereignty
28 of 30
What is your data centre Power Usage Effectiveness (PUE) and do you track thermal compliance?
Why this matters: ASHRAE TC 9.9 defines allowable temperature and humidity ranges for IT equipment. PUE measures energy efficiency (1.0 = perfect, 2.0 = 50% wasted). NABERS rates energy efficiency on a 1-6 star scale. Average global PUE is 1.58; best-in-class is below 1.2.
Phase 7: DC Governance & Data Sovereignty
29 of 30
Do you have data sovereignty or data residency requirements for the jurisdictions you operate in?
Why this matters: India's DPDP Act 2023 restricts cross-border data transfer to notified countries only. Australia's PSPF requires government data on Australian soil. GDPR restricts transfers outside the EEA without adequacy decisions. Many organisations unknowingly breach residency requirements through cloud provider replication.
Phase 7: DC Governance & Data Sovereignty
30 of 30
What disaster recovery and business continuity capabilities does your DC infrastructure support?
Why this matters: Uptime Tier III requires concurrent maintenance without downtime. Tier IV is fault-tolerant. EN 50600 Availability Class 3-4 requires automatic failover. Your DR/BCP capability directly affects your audit outcomes under APRA CPS 232, SOCI, and ISO 22301.