What is the purpose of the Cyber GRC Maturity Quiz?

The Cyber GRC Maturity Quiz helps organisations assess their current state of governance, risk management, and compliance capabilities across five maturity levels: Initial, Developing, Defined, Managed, and Optimised. By answering questions about your GRC processes, tools, and practices, you'll receive a maturity score that identifies strengths, gaps, and actionable recommendations for improvement. The quiz is designed to provide CISOs and risk leaders with a quick benchmark of where they stand and practical next steps to enhance their cyber risk management programme.

How long does it take to complete the quiz?

The quiz typically takes 5-7 minutes to complete. It consists of carefully crafted multiple-choice questions covering key GRC dimensions including risk assessment processes, compliance management, control monitoring, third-party risk management, reporting and governance, and technology enablement. Each question includes context to help you select the most accurate answer, and you can move back and forth between questions before submitting. There's no time limit—take as much time as you need to provide thoughtful responses.

Is my quiz data kept confidential?

Yes, absolutely. Your quiz responses and contact information are kept strictly confidential and used solely to provide you with personalised maturity assessment results and follow-up support from our team. We do not share, sell, or publicly disclose individual quiz results. Data is stored securely in compliance with data protection regulations (GDPR, CCPA). If you choose to provide your contact information after completing the quiz, it's optional and used only to send you your detailed results and enable our team to offer relevant guidance based on your maturity level.

Can I retake the quiz or see my previous results?

Yes, you can retake the quiz at any time to track your organisation's GRC maturity progress over time. We recommend retaking the assessment every 6-12 months or after significant changes to your risk management programme (e.g., implementing new GRC tools, achieving certifications, expanding compliance scope). If you provided your email when submitting results, your detailed assessment is sent to you for future reference. Contact our team if you'd like to compare results over time or discuss how your maturity trajectory aligns with industry benchmarks.

How should I interpret my maturity score and recommendations?

Your maturity score reflects your organisation's current GRC capabilities based on your responses. The accompanying recommendations are tailored to your specific level and suggest concrete next steps: (1) Initial level—Focus on establishing foundational processes and basic documentation, (2) Developing level—Standardise processes and implement GRC tools, (3) Defined level—Enhance automation and implement continuous monitoring, (4) Managed level—Optimise existing processes with advanced analytics and risk quantification, (5) Optimised level—Drive continuous improvement and strategic risk integration. Use the recommendations as a roadmap to prioritise GRC investments and build your business case for improvement initiatives.

Will someone from Acuity contact me after I complete the quiz?

Only if you choose to provide your contact information in the optional form after viewing your results. If you complete the contact form, a member of our team will reach out within 1-2 business days to discuss your maturity assessment, answer questions, and explore how STREAM® might help address the gaps identified in your quiz results. There's no obligation—we respect your time and focus on providing value. If you prefer to explore independently, you can simply view your results without providing contact information.

How does the quiz relate to STREAM® capabilities?

The quiz dimensions directly map to STREAM® platform capabilities, helping you understand which features would provide the most value based on your maturity level and identified gaps. For example: (1) Risk assessment questions → STREAM®'s risk register and quantification features, (2) Compliance questions → Multi-framework compliance automation and unified control mapping, (3) Control monitoring questions → Continuous control monitoring (100+ integrations with STREAM® Classic), (4) TPRM questions → Vendor risk management hub and automated assessments, (5) Reporting questions → Executive dashboards and board-ready risk reporting. The quiz essentially provides a gap analysis that can inform your STREAM® implementation priorities.

Cyber GRC Maturity Assessment

Q: What do the five maturity levels mean?

The five maturity levels represent progressive stages of GRC sophistication: (1) Initial—Ad-hoc, reactive processes with minimal documentation and heavy reliance on individual knowledge, (2) Developing—Basic processes emerging but inconsistently applied with limited automation, (3) Defined—Documented, standardised processes consistently followed across the organisation with some automation, (4) Managed—Proactive, measured processes with extensive automation, continuous monitoring, and data-driven decision-making, and (5) Optimised—Advanced, continuously improving processes fully integrated into business operations with predictive analytics and strategic risk management capabilities.

Discover how your organisation's cyber risk management measures up

TL;DR

A 5–7 minute assessment that scores your GRC maturity across five levels and provides personalised recommendations. Results are immediate and confidential.

Quiz takes 5-7 minutes • Results provided immediately

Understanding GRC Maturity Levels

Initial

Ad-hoc, reactive processes with minimal documentation and heavy reliance on individual knowledge

Developing

Basic processes emerging but inconsistently applied with limited automation

Defined

Documented, standardised processes consistently followed across the organisation with some automation

Managed

Proactive, measured processes with extensive automation, continuous monitoring, and data-driven decision-making

Optimized

Advanced, continuously improving processes fully integrated into business operations with predictive analytics

Question 1 of 3

How does your organisation identify cyber risks?

Manually - risks are added to the risk register as they're identified

We use a systematic approach to ensure all material risks are identified in all environments

Not sure