ARMOR Online Self-Assessment⇱

Assessment Instructions

For each question, select the value that best represents your organization’s current practice. Use your best judgment, the goal is to identify where your organization truly operates today, not where it aspires to be.

Value	Label	Description
1	Emerging	Practices are ad hoc or inconsistently applied. Activities are primarily reactive or compliance-driven.
2	Developing	Practices are defined and repeatable but not yet strategic. Processes exist, though integration and sustainment vary across teams or systems.
3	Established	Practices are formalized, sustained, and measured. Outcomes are consistently used to drive improvement and inform tactical, operational, and management decisions.

Section 1 – Governance & Strategy

1) Does the organization have a documented risk-aligned offensive security strategy? 1 2 3 2) Are roles and responsibilities for offensive security clearly defined across the organization? 1 2 3 3) Is leadership regularly briefed on offensive security outcomes and risk implications? 1 2 3 4) Are offensive security results used to inform policy, investment, or strategic decisions? 1 2 3 5) Are threat intelligence and risk context incorporated into planning and prioritization? 1 2 3

Section 2 – Testing Cadence & Scope

6) How consistently are penetration tests or security assessments performed? 1 2 3 7) Does testing include cloud, SaaS, and third-party, and on-prem assets? 1 2 3 8) Are red/purple team exercises conducted to measure detection and response capability? 1 2 3 9) Are test scopes threat-informed (based on adversary behaviors or emerging risks)? 1 2 3 10) Are tabletop exercises or crisis simulations conducted for critical systems and processes? 1 2 3

Section 3 – Remediation & Sustainment

11) Are findings triaged, prioritized, and tracked to resolution within defined SLAs? 1 2 3 12) Is remediation validated through retesting or continuous validation processes? 1 2 3 13) Are recurring or systemic findings analyzed for root causes and process improvement? 1 2 3 14) Are sustainment metrics (e.g., remediation rate, mean time to validate) reviewed regularly? 1 2 3 15) Are remediation and validation processes documented and reviewed for effectiveness? 1 2 3

Section 4 – Integration & Collaboration

16) Are offensive security results communicated to defensive and operations teams? 1 2 3 17) Are red/purple team insights used to improve detection and response capabilities? 1 2 3 18) Do business units understand and act on relevant offensive security outcomes? 1 2 3 19) Are results integrated with enterprise risk management reporting and dashboards? 1 2 3 20) Are cross-functional reviews or after-action reports conducted following exercises? 1 2 3

Privacy Note: Responses entered into the online assessment are calculated entirely within your browser. Only the calculated overall numeric average is recorded in website analytics. Answers to specific questions about your offensive security processes are not recorded.