Nine questions that establish where a nation actually stands.
Four minutes, answered honestly, produces a maturity band, your three weakest divisions, an estimated time to a defined baseline, and the sequence we would recommend starting with. Nothing you enter leaves your browser.
How to score
One question per division from Part 3. Each is phrased as something a competent staff officer either can or cannot do today, because capability that cannot be demonstrated on demand is not capability. Use the same five levels throughout.
The assessment
Answers default to ad hoc, which is where most national programs genuinely sit before a first engagement. Change each to what is true for you.
National readiness assessment
Hardware and firmware
Can you establish whether a server, router or industrial controller in your estate is running the firmware it shipped with?
Network visibility
What share of national traffic crosses a sensor your government controls, expressed as a number you could defend?
Endpoint coverage
Could you query every government endpoint for one indicator and have a complete answer today?
Cloud and identity
Do you know every path from an ordinary user account to full control of your largest directory?
Application security
Are citizen facing services protected by anything that understands how they are supposed to behave, beyond a perimeter filter?
Detection engineering
When one analyst understands a new technique, how long until every sensor in the country detects it?
Malware analysis
When a sample is captured from a national incident, how long until a detection built from it is deployed?
Intelligence and forensics
Could you reconstruct an intrusion into a narrative that survives legal challenge or allied scrutiny?
Command and authority
Is there a named commander, a legal mandate for access, and a rehearsed decision path at three in the morning?
Recommended first sequence
- Hardware and firmware. Build a firmware inventory for one critical sector before buying any attestation product. You cannot attest what you have not listed.
- Network visibility. Place sensors at the government core and the two largest carriers, then report coverage as a weekly percentage rather than an assurance.
- Endpoint coverage. Deploy an endpoint agent across one ministry end to end and prove a fleet wide query returns in minutes.
This is a self-assessment and not an audit. It is calibrated against national programs of comparable scope, and it will overstate readiness wherever coverage is assumed rather than measured. An assessment engagement exists precisely to replace these nine estimates with evidence.
Reading the result
The total matters less than the shape. A country scoring evenly at level two across all nine divisions is in a stronger position than one averaging higher with two divisions at zero, because an adversary selects the lowest scoring layer and does not care about the average.
Divisions with no owner are the finding to act on. A zero means no person in the country is accountable for that layer, which is different from being under-resourced, and it is usually cheaper to fix than it looks. Naming an owner and giving them a build mandate costs one appointment.
The time estimate assumes work proceeds on two divisions in parallel with funding and authority already in place. Where legal authority is the constraint, add the lead times in Part 2, Table 3, which cannot be compressed by spending.
Bring the result to the briefing.
The most productive first conversation starts from your own scoring. We work through where the estimate is likely to be optimistic, what evidence would settle it, and what the first twelve months would produce given your institutions and your budget.
Autogon Inc.. This instrument runs locally in your browser and transmits, stores and logs nothing. Maturity bands and time estimates are planning aids calibrated against national programs of comparable scope, not measurements of your estate.