SimplifiedCS
SIMPLIFIEDCS / PROTOTYPE v0.1 · NIST CSF 2.0 · CIS Controls v8
Sample This is example data from a fixed, realistic answer set - not a real assessment result.
Synthesis - all functions considered jointly

Health Reading

Assessed against: NIST CSF 2.0 + CIS Controls v8 + HIPAA · Healthcare

Infrastructure snapshot (self-reported)

Organization size
201–1,000
Dedicated IT/security team
Yes, dedicated IT and cybersecurity team - 3–10 (+1–2 cybersecurity)
Security managed by
In-house team manages everything, no services outsourced
EDR / antivirus
CrowdStrike Falcon
Email security gateway
Mimecast
Awareness / LMS platform
KnowBe4
DLP solution
Yes - Microsoft Purview
Deployment model
Hybrid (on-prem + cloud) - Microsoft Azure
Network architecture
Segmented (VLANs / zones)
SD-WAN
No
External-facing devices
Yes
Firewall / VPN appliance
Fortinet FortiGate
External-facing services
Yes, DB-connected: Yes
Hosting / web stack
Amazon Web Services (AWS) - Nginx on Ubuntu 22.04
Containerization
Yes, some workloads
Virtualization
Yes, on-prem hypervisor (e.g. VMware, Hyper-V)
Develops custom software
Yes
DevSecOps maturity
Security scanning exists but isn't enforced in the pipeline
Secrets management
Environment variables, informally managed
OT / ICS environment
No

Higher percentages mean a stronger security posture - not compliance completeness, not exposure level. 100% would mean every control this assessment checks for is fully in place; it doesn't mean risk-free.

61%
Moderate exposure
Your Team & Vendors
64%
Data & Systems
63%
Access & Identity
57%
Detection & Monitoring
50%
Incident Readiness
83%
Recovery & Continuity
50%

Compounding risk - patterns across steps

Combined finding - A public-facing web app that connects to a backend database, without centralized logging or outbound-traffic monitoring, is precisely the setup where a SQL injection or similar attack goes unnoticed long enough to exfiltrate the entire database.

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated you operate an externally-reachable customer-facing service ("Yes") connected to a backend database ("Yes"), with logging "Yes" and outbound-traffic monitoring "No".
  • Attack pattern: Exploit Public-Facing Application (MITRE ATT&CK T1190) - A public web app connected to a database is a direct target for this technique - things like SQL injection against the app itself. Centralized logging and outbound-traffic monitoring are what typically catch the follow-on data exfiltration; without them, a successful exploit can run for a long time before anyone notices.
  • Interim step: Regular vulnerability scanning helps catch some exploitable issues before they're used, but it doesn't replace monitoring for exfiltration after the fact. As an immediate step, turn on your hosting or cloud provider's built-in access/traffic logging - most include this at no extra cost, and it beats having no visibility at all.
  • How to fix it: Put a web application firewall in front of the app (most cloud providers and CDNs offer one), run an authenticated vulnerability/injection scan against it, and enable outbound-traffic alerting for unusually large data transfers - together these address the entry point, the flaw, and the exfiltration step.
  • OWASP Top 10: A09:2021 - Security Logging and Monitoring Failures, with the matching Playbook →
  • Reference: OWASP Top 10
Combined finding - A database that isn't encrypted at rest, combined with routine application access through shared or admin credentials rather than least-privilege accounts, means a single leaked credential - or a misplaced backup - exposes the entire dataset in plain, readable form, not just whatever the compromised account was meant to touch.

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated the database is encrypted at rest: "No / not sure", and routine application access uses least-privilege credentials: "No - shared or admin credentials are used for routine app access".
  • Attack pattern: Data from Local System (MITRE ATT&CK T1005) - A database that isn't encrypted at rest, combined with routine application access through shared or admin credentials rather than least-privilege accounts, means a single leaked credential - or a misplaced backup - exposes the entire dataset in plain, readable form, not just whatever the compromised account was meant to touch.
  • Interim step: As an immediate step, rotate the shared/admin credential currently used for routine app access and restrict it to only the specific tables/operations the application actually needs, even before a fully separate least-privilege account is provisioned.
  • How to fix it: Enable at-rest encryption (a native feature on every major database engine and managed cloud database service - typically a configuration change, not a migration) and create a dedicated, least-privilege application account scoped to only what the app needs, retiring the shared/admin credential from routine use.
  • OWASP Top 10: A02:2021 - Cryptographic Failures, with the matching Playbook →
  • Reference: OWASP Top 10
Combined finding - Cloud or hybrid infrastructure without MFA enforced is a materially larger exposure than the same gap on a purely on-premises setup - cloud admin consoles are reachable from anywhere a leaked password reaches.

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated your infrastructure is "Hybrid (on-prem + cloud)" with MFA enforcement "No".
  • Attack pattern: Valid Accounts: Cloud Accounts (MITRE ATT&CK T1078.004) - The cloud-specific version of credential-based access - a leaked password alone is enough to reach admin consoles that are reachable from anywhere in the world, not just from inside your office network.
  • Interim step: A strong password policy is already enforced, which raises the bar somewhat - but it doesn't stop a reused or phished password. Prioritize MFA on the cloud admin console / root account specifically first; that single account is the highest-value target and the fastest thing to lock down.
  • How to fix it: Enforce MFA on every cloud account, starting with the root/global-admin account today, then every account with any administrative role, then all remaining users - most cloud providers (AWS, Azure, GCP) let you enforce this org-wide from a single console setting.
  • Reference: Microsoft Entra: multifactor authentication overview

Vendor-specific mitigation notes

Fortinet - Fortinet's FortiOS/FortiGate line has had multiple critical, actively-exploited authentication-bypass and RCE vulnerabilities in recent years. Regardless of current patch level: confirm firmware is on a currently-supported, patched release; avoid exposing the management interface to the internet; and enforce MFA on SSL-VPN.
Mimecast - Mimecast email security deployments are commonly found with misconfigured DMARC alignment or impersonation-protection settings left at default - confirm these are actively enforced, not merely available in the license.
KnowBe4 - Awareness platforms like KnowBe4 are only as effective as their completion and simulated-phishing-failure rates are actually reviewed by someone - track those metrics on a schedule, don't just deploy the training and move on.

Illustrative, based on well-documented historical exploitation patterns for named products - not a live feed. This tool intentionally doesn't do vulnerability scanning; treat this as a prompt to check current vendor advisories for your exact version, not a substitute for doing so.

Compliance considerations

HIPAA - HIPAA's Security Rule requires a documented risk analysis, executed Business Associate Agreements with every vendor touching PHI, and encryption of PHI - gaps in any of these are among the most commonly cited findings in HHS OCR enforcement actions.
Gap: Do you have signed Business Associate Agreements (BAAs) with every vendor that accesses, stores, or transmits PHI? - currently: "With some, not all"

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "With some, not all" for: "Do you have signed Business Associate Agreements (BAAs) with every vendor that accesses, stores, or transmits PHI?"
  • Attack pattern: Supply Chain Compromise (MITRE ATT&CK T1195) - A vendor touching PHI without a signed BAA means there's no contractual assurance of their security controls, and a breach at their end becomes your HIPAA liability with no documented risk allocation.
  • Interim step: Identify which current vendors touch PHI without a signed BAA and prioritize outreach to just that list first.
  • How to fix it: Execute a BAA with every vendor that creates, receives, maintains, or transmits PHI before continuing to share data with them.
Gap: Have you conducted a HIPAA-required security risk analysis covering all systems that create, receive, maintain, or transmit ePHI? - currently: "Yes, but outdated or partial"

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "Yes, but outdated or partial" for: "Have you conducted a HIPAA-required security risk analysis covering all systems that create, receive, maintain, or transmit ePHI?"
  • What could go wrong: A HIPAA risk analysis has to cover every system that creates, receives, maintains, or transmits ePHI - letting it go stale or skipping it means you can't demonstrate you actually know where your PHI exposure is, one of the most commonly cited findings in real OCR enforcement actions.
  • Interim step: List every system that touches ePHI today as an interim inventory, even before a full risk analysis is redone.
  • How to fix it: Commission or conduct a current, comprehensive HIPAA security risk analysis covering all ePHI systems, and track remediation of findings on a schedule.

This is pattern-based guidance from your own answers, not a certification audit or legal compliance determination.

Where to act first, ranked

Ranked by risk, not by question order: how directly the gap enables a common attack (the controls CISA's Cross-Sector Performance Goals and #StopRansomware guidance put first rank highest), how far your answer is from the strongest option, and whether it feeds a combined finding above.

01
Access & Identity: Is multi-factor authentication enforced for remote and admin access? Critical control

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "No" for: "Is multi-factor authentication enforced for remote and admin access?"
  • Attack pattern: Valid Accounts (MITRE ATT&CK T1078) - MFA is the specific control that stops a leaked or guessed password alone from being enough to log in as a legitimate user.
  • Interim step: A strong password policy is enforced, which helps somewhat - prioritize MFA on admin and remote-access accounts first, since those are the highest-value targets.
  • How to fix it: Enforce MFA for every account, not just admins - most identity providers (Microsoft Entra, Google Workspace, Okta) support org-wide enforcement from one setting.
  • Reference: CISA: Require Multifactor Authentication
02
Recovery & Continuity: Are backups isolated from the production network (offline or immutable)? Critical control

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "No" for: "Are backups isolated from the production network (offline or immutable)?"
  • Attack pattern: Inhibit System Recovery (MITRE ATT&CK T1490) - Ransomware operators specifically target connected backup systems and shadow copies to prevent recovery, not just the primary systems - a backup reachable from the production network can be encrypted or deleted right alongside everything else.
  • Interim step: As an interim step, prioritize moving just the most recent backup set to an offline or immutable copy - the full re-architecture can follow, but one truly isolated recent copy is what actually matters in a live ransomware scenario.
  • How to fix it: Adopt the 3-2-1 backup rule (3 copies, 2 media types, 1 offline/immutable) so at least one copy is structurally unreachable from a network-based ransomware event.
  • Reference: CISA: StopRansomware
03
Access & Identity: Is that database encrypted at rest? High impact

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "No / not sure" for: "Is that database encrypted at rest?"
  • Attack pattern: Data from Local System (MITRE ATT&CK T1005) - An unencrypted database means a stolen backup, a misconfigured storage bucket, or a leaked credential exposes the data in plain, immediately-usable form - encryption at rest is what makes a stolen copy alone insufficient.
  • Interim step: As an interim step, confirm at minimum that any database backups or exports are encrypted, even if the live database itself isn't yet.
  • How to fix it: Enable at-rest encryption - a native, typically low-effort setting on every major database engine and managed cloud database service, not a migration project.
  • OWASP Top 10: A02:2021 - Cryptographic Failures, with the matching Playbook →
04
Access & Identity: Does routine application access to that database use least-privilege, application-specific credentials - not a shared or admin/root account? High impact

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "No - shared or admin credentials are used for routine app access" for: "Does routine application access to that database use least-privilege, application-specific credentials - not a shared or admin/root account?"
  • Attack pattern: Valid Accounts (MITRE ATT&CK T1078) - Routine application access through a shared or admin database credential means a single compromised credential (from the app server, a leaked config file, or a former employee) grants broad, often unaudited access to the entire database.
  • Interim step: As an interim step, restrict the current shared/admin credential to only the specific tables or operations the application actually needs.
  • How to fix it: Provision a dedicated, least-privilege application account scoped to only what the app requires, and retire the shared/admin credential from routine use.
  • OWASP Top 10: A01:2021 - Broken Access Control, with the matching Playbook →
05
Detection & Monitoring: Do you monitor for data exfiltration or unusual outbound traffic? High impact

Why this matters, and what to do now

▸
  • Why this was flagged: You indicated "No" for: "Do you monitor for data exfiltration or unusual outbound traffic?"
  • Attack pattern: Exfiltration Over C2 Channel (MITRE ATT&CK T1041) - Without monitoring for unusual outbound traffic, this is how a breach goes from "contained" to "data actually left the building" without anyone noticing at the time.
  • Interim step: Centralized logging exists - as an interim step, add a basic alert for large or unusual outbound data transfers using what's already being collected, rather than waiting on a dedicated exfiltration-monitoring tool.
  • How to fix it: Enable outbound traffic monitoring with alerting on unusually large or unusual-destination transfers - most modern firewalls and cloud platforms support this as a built-in feature.

Every gap in this assessment (31)

The full list behind the five above, grouped by area and ordered by the same risk ranking within each. The number is each gap's overall rank.

Your Team & Vendors

5 gaps
▸
20
Is there a documented cybersecurity policy, approved by leadership? Standard
Your answer: "Yes, but outdated or unreviewed"
How to fix it: Draft a short (1-2 page) policy covering scope, acceptable use, and access basics, and get explicit leadership sign-off - a real, if brief, policy beats a comprehensive one that never gets approved.
21
Does leadership receive regular reporting on cybersecurity risk? Standard
Your answer: "Ad hoc, when something goes wrong"
How to fix it: Establish at least a quarterly risk report to leadership covering top findings and progress against them.
22
Is cybersecurity risk factored into business decisions (new vendors, new products) before they're approved? Standard
Your answer: "Sometimes, informally"
How to fix it: Add a short vendor security questionnaire as a required step before contract signature for any new vendor touching systems or data.
23
Do you have signed Business Associate Agreements (BAAs) with every vendor that accesses, stores, or transmits PHI? Standard
Your answer: "With some, not all"
How to fix it: Execute a BAA with every vendor that creates, receives, maintains, or transmits PHI before continuing to share data with them.
24
Are AI tools used within the organization, and if so, is that usage tracked and governed? Standard
Your answer: "Used informally - some awareness, no formal policy"
How to fix it: Establish a formal AI usage policy naming approved tools, prohibited data categories, and track usage the same way other software is inventoried.

Data & Systems

3 gaps
▸
09
How would you describe your asset inventory? High impact
Your answer: "Partial, manually maintained spreadsheet"
How to fix it: Deploy automated asset discovery (many EDR and network tools include this) and review the inventory at least quarterly.
10
How many third-party vendors have access to your systems or data? High impact
Your answer: "1–5, informally tracked"
How to fix it: Build a vendor inventory recording what each vendor can access, and require a lightweight security review before granting any new vendor access going forward.
25
Have you conducted a HIPAA-required security risk analysis covering all systems that create, receive, maintain, or transmit ePHI? Standard
Your answer: "Yes, but outdated or partial"
How to fix it: Commission or conduct a current, comprehensive HIPAA security risk analysis covering all ePHI systems, and track remediation of findings on a schedule.

Access & Identity

16 gaps - 3 on critical controls
▸
01
Is multi-factor authentication enforced for remote and admin access? Critical control
Your answer: "No"
How to fix it: Enforce MFA for every account, not just admins - most identity providers (Microsoft Entra, Google Workspace, Okta) support org-wide enforcement from one setting.
03
Is that database encrypted at rest? High impact
Your answer: "No / not sure"
How to fix it: Enable at-rest encryption - a native, typically low-effort setting on every major database engine and managed cloud database service, not a migration project.
04
Does routine application access to that database use least-privilege, application-specific credentials - not a shared or admin/root account? High impact
Your answer: "No - shared or admin credentials are used for routine app access"
How to fix it: Provision a dedicated, least-privilege application account scoped to only what the app requires, and retire the shared/admin credential from routine use.
06
How are software patches and updates managed? Critical control
Your answer: "Scheduled but inconsistent"
How to fix it: Automate patch deployment with a defined SLA (e.g. critical patches within 72 hours, everything else within 30 days) rather than ad hoc manual patching.
07
How are privileged accounts (domain admins, database admins, local/server administrators) managed? Critical control
Your answer: "Individually assigned, but not regularly reviewed"
How to fix it: Individually assign every privileged account (no shared logins), and schedule a recurring (at least quarterly) access review with least-privilege enforcement.
11
Does your organization support passkeys or other passwordless authentication methods (e.g. WebAuthn/FIDO2, platform biometrics), in addition to or instead of passwords? Standard
Your answer: "No - passwords (with or without a separate MFA step) are the only option"
How to fix it: Enable passkey/WebAuthn support in your identity provider (Microsoft Entra, Google Workspace, and Okta all support this natively) starting with admin and highest-risk accounts, then expand.
12
Is the database software itself (not just the application) kept current and patched? High impact
Your answer: "Patched, but inconsistently or behind schedule"
How to fix it: Put database software on the same defined patch cadence as the rest of your infrastructure - most managed cloud database services offer automatic minor-version patching as a configuration option.
13
Is email authentication (SPF, DKIM, and DMARC set to quarantine/reject) enforced for your domain? High impact
Your answer: "Partially - e.g. DMARC set to "none""
How to fix it: Publish SPF and DKIM records and move DMARC to full enforcement (reject) once you've confirmed legitimate mail flows aren't affected during a quarantine period.
14
Is there a formal process to revoke all access immediately when someone leaves or changes roles? High impact
Your answer: "Informal / inconsistent"
How to fix it: Automate access revocation tied to HR's own termination workflow (most identity providers support this integration) so it doesn't depend on someone remembering a manual step.
15
Does that retrieval respect the same access permissions the underlying documents already have, or could someone using it potentially see more than they'd normally have access to? High impact
Your answer: "Partially - some permission boundaries respected, not comprehensively enforced"
How to fix it: Rebuild retrieval so it queries with the requesting user's own identity/permissions rather than a broad service account, so results are filtered to what that specific user could already see in the source system - most enterprise RAG platforms support this natively.
16
For payment changes or other sensitive requests, is there an authenticated, out-of-band verification step that would still hold up even if email, voice, and video were all convincingly impersonated? High impact
Your answer: "Some verification exists, but not out-of-band or not consistently applied"
How to fix it: Define and enforce an authenticated, out-of-band verification step (a callback to a known number, or in-person confirmation) for payment changes and other sensitive requests, documented as a required step regardless of how convincing the original request appeared.
26
Do you run simulated phishing tests for employees? Standard
Your answer: "Yes, but infrequently (less than annually)"
How to fix it: Add recurring simulated phishing tests (monthly or quarterly) and track click/report rates over time as the real measure of whether training works.
27
For those separate admin accounts, is elevated access always-on (standing privileges) or granted just-in-time for specific tasks? Standard
Your answer: "Some just-in-time elements, not fully enforced"
How to fix it: Adopt a privileged access management (PAM) solution or your identity provider's built-in just-in-time elevation feature (Microsoft Entra PIM, for example) so elevated access is granted per-task and expires automatically.
28
Do administrators and/or employees use a password management tool? Standard
Your answer: "Some individuals use one informally"
How to fix it: Deploy an organization-provisioned password manager (most business identity/security suites include one) so unique passwords per service become the default, not a personal discipline problem.
29
Is AI-generated code or AI tool output reviewed the same way human-written code is, before being merged or deployed? Standard
Your answer: "Partially - reviewed sometimes, not consistently"
How to fix it: Apply your existing code review and CI security-gate requirements to AI-generated output with no exception - the source of a change shouldn't determine whether it gets reviewed.
30
Has security awareness training been updated to address AI-generated phishing and voice/video impersonation specifically, not just traditional phishing? Standard
Your answer: "Mentioned, but not a dedicated focus"
How to fix it: Update security awareness training to explicitly cover AI-generated phishing and voice/video impersonation, including at least one realistic example, alongside the existing traditional-phishing content.

Detection & Monitoring

4 gaps
▸
05
Do you monitor for data exfiltration or unusual outbound traffic? High impact
Your answer: "No"
How to fix it: Enable outbound traffic monitoring with alerting on unusually large or unusual-destination transfers - most modern firewalls and cloud platforms support this as a built-in feature.
17
How quickly would you typically notice a suspicious login or anomaly? High impact
Your answer: "Days - manual review"
How to fix it: Deploy automated alerting on anomalous logins and behavior (via SIEM correlation rules or your identity provider's built-in risk detection) so detection happens in minutes to hours, not never.
18
Do you run regular external and internal vulnerability scans? High impact
Your answer: "Occasionally / ad hoc"
How to fix it: Schedule regular (at minimum quarterly, ideally continuous) external and internal vulnerability scans, and track findings to remediation.
31
Have you had an external penetration test or red-team engagement in the last 12 months? Standard
Your answer: "More than 12 months ago"
How to fix it: Schedule an external penetration test or red-team engagement at least annually, and after any major infrastructure change.

Incident Readiness

1 gap
▸
19
Do you have a documented incident response plan? High impact
Your answer: "Yes, but never tested"
How to fix it: Write a documented incident response plan and test it annually via a tabletop exercise, updating it based on what the exercise reveals.

Recovery & Continuity

2 gaps - 2 on critical controls
▸
02
Are backups isolated from the production network (offline or immutable)? Critical control
Your answer: "No"
How to fix it: Adopt the 3-2-1 backup rule (3 copies, 2 media types, 1 offline/immutable) so at least one copy is structurally unreachable from a network-based ransomware event.
08
How often are backups tested by actually restoring data? Critical control
Your answer: "Rarely"
How to fix it: Schedule quarterly (at minimum) backup-restore tests against real systems, documenting actual restore time against your required recovery targets.
About this report - everything above is produced by running a fixed sample answer set through this site's real, deterministic scoring engine - the same one every actual assessment uses - so this sample stays accurate as that engine evolves, rather than being a separately-maintained mockup.

AI-Enhanced Insights AI-generated

A static example of what the live, opt-in "Get AI-Enhanced Insights" pass on a real report looks like, shown here without an actual API call so the sample stays instant and free to view.

Live vendor/product check

Fortinet FortiGate - FortiGate/FortiOS has a recent history of critical, actively-exploited authentication-bypass CVEs. No CVE specific to this exact configuration was found, but firmware currency is worth confirming directly given that track record. (CISA KEV catalog (pattern match, illustrative))
Mimecast - No current actively-exploited CVEs found against Mimecast's email security platform. (NVD CVE database (illustrative))

Beyond the rules engine

Segmented network architecture, but MFA not enforced at all
A segmented network limits lateral movement after a breach, but doesn't stop the initial compromise - and with MFA off entirely, a single leaked password is enough to get in. These two answers don't individually look alarming, but MFA is usually the higher-leverage fix precisely because it blocks the step that happens before segmentation would even matter.

Synthesis

This is a reasonably well-run environment for its size - recurring security training, enforced logging, and a segmented network are all real, working fundamentals. The two flagged gaps (no MFA enforcement, and no outbound-traffic monitoring on a database-connected public app) are specific and fixable rather than symptomatic of a broader absence of controls, which is a meaningfully different starting point than an org with no program at all.