Epitechnic Zero Trust Maturity Assessment Questionnaire

1
Introduction to the Zero Trust Maturity Assessment Questionnaire

In today’s digital-first world, protecting your organisation's assets and operations is more critical than ever. The Zero Trust approach is a modern cybersecurity strategy that assumes no entity, inside or outside your network, can be trusted by default. It enforces the principle of "never trust, always verify" to deliver robust protection against evolving threats.

This questionnaire is designed to help business leaders assess their organisation’s Zero Trust maturity.

For each question, it is unlikely that a single option will perfectly align with your organisation's circumstances. Therefore, select the answer that best reflects your current practices and approach.
2
How does your organisation ensure access to systems and data?* This field is required.Identity Management
My organisation uses basic authentication, relying on passwords or simple MFA, with access rarely updated.
My organisation uses improved authentication, combining MFA with additional checks like location or activity.
My organisation uses advanced authentication, employing phishing-resistant MFA and adding security layers like behaviour checks.
My organisation uses continuous authentication, with phishing-resistant MFA actively verifying identity during the session.
3
How are devices managed and secured within your organisation?* This field is required.Device Security
My organisation does not track assets effectively, managing devices and supply chain processes in an ad-hoc way, with limited understanding of risks.
My organisation tracks physical and some virtual assets and manages supply chain risks by following established policies and frameworks.
My organisation is building a comprehensive view of assets, using automated tools to track acquisitions, monitor development, and assess third-party risks.
My organisation has a real-time view of all assets, automates supply chain risk management, ensures resilience to failures, and follows best practices.
4
How is network segmentation and traffic control handled?* This field is required.Network Protection
My organisation uses basic network architecture, relying on large, broad segments with limited restrictions and bulk VPN tunnels for connectivity.
My organisation started to isolate critical workloads, restricting connectivity to what is necessary and transitioning to service-specific connections.
My organisation expanded isolation mechanisms, adding micro-perimeters and service-specific connections to protect more of the network.
My organisation has fully distributed micro-segmentation, dynamically providing just-in-time and minimal connectivity tailored to specific services.
5
What is the organisation’s approach to protecting sensitive data?* This field is required.Data Security
My organisation encrypts only minimal data at rest and in transit, relying on manual or ad hoc processes to manage and secure encryption keys.
My organisation encrypts all data in transit and, where possible, data at rest, while starting to implement formal policies for managing and securing encryption keys.
My organisation encrypts all data at rest and in transit across the enterprise and ensures encryption keys are well-protected and regularly rotated.
My organisation encrypts data in use where appropriate, applies least privilege principles for key management, and uses the latest standards and cryptographic agility across the enterprise.
6
How is threat protection applied?* This field is required.Application Threat Protection
My organisation has minimal threat protections integrated with application workflows, applying only general-purpose protections for known threats.
My organisation integrates threat protections into mission-critical application workflows, addressing known threats and some application-specific risks.
My organisation integrates threat protections across all application workflows, defending against application-specific and targeted threats.
My organisation integrates advanced threat protections into all application workflows, providing real-time visibility and content-aware defences against sophisticated, tailored attacks.
7
How are security policies implemented and monitored?* This field is required.Governance and Policy Enforcement
My organisation relies on ad hoc governance policies, such as those for protection, categorisation, access, and storage, with manual implementation.
My organisation defines high-level governance policies but relies on manual and segmented implementation.
My organisation is beginning to integrate lifecycle policy enforcement across the enterprise, creating more unified governance definitions.
My organisation has fully unified lifecycle policies that are dynamically enforced across the entire enterprise.
8
How does your organisation monitor its environment for threats?* This field is required.Visibility and Analytics
My organisation has limited visibility, with insights and analysis primarily based on manual processes.
My organisation gains visibility through inventory management, categorisation, and monitoring of access attempts, with some automation.
My organisation maintains comprehensive enterprise-wide visibility, supported by automated analysis and correlation.
My organisation has full lifecycle visibility with robust analytics, including predictive insights, to provide a complete and dynamic understanding.
9
How are security operations and responses managed?* This field is required.Automation and Orchestration
My organisation implements lifecycle and security policies, such as access, usage, storage, and protection, using manual and often ad hoc processes.
My organisation uses some automated processes to implement lifecycle and security policies.
My organisation implements lifecycle and security policies primarily through automated methods in a consistent, tiered, and targeted manner across the enterprise.
My organisation automates lifecycle and security policies to the maximum extent possible, ensuring consistent implementation across the enterprise.
10
What email address would you like us to send your report to?* This field is required.
example@example.com
11
What is your company name?* This field is required.
12
What is your title* This field is required.
13
Would you like to receive occasional emails with useful tips and tools?* This field is required.You can opt out at any time.
Opt in
Opt out
14
Form TitleThis is used to store the form title
Should be Empty: