Frequently asked questions

Does a high score mean we are secure?

No; this original score measures readiness to specify and oversee a service. NIST's risk-management guidance supports structured work, not a guarantee that a single numerical score establishes security.

Is this a NIST or CISA assessment?

No; the questions, point values and bands were created for this research. CISA's service-customer guidance is contextual evidence, not an endorsement or validation of the scoring method.

Should unknown answers receive partial credit?

Use zero until relevant evidence exists, so uncertainty stays visible. This is our scoring rule, informed by the need to define responsibilities in incident-response planning.

Can a provider complete the quiz for us?

A provider can supply evidence, but the buyer should own the answers and business decisions. CISA's customer perspective is useful when distinguishing outsourced delivery from customer responsibilities.

Does this quiz satisfy a compliance requirement?

No; applicable requirements and evidence need their own review. For example, HHS's Security Rule guidance describes obligations that cannot be replaced by this editorial score.