← PolicyReady · Full checklist with CISA goal codes

Cybersecurity readiness self-check

Answer for each control: Yes, Partial or No. The score and the ranked gap list update as you go.

A readiness self-check, not an audit. This is a structured self-report against published guidance. It is not a security audit, a penetration test, a certification or a compliance determination, and nothing here promises a particular insurance outcome. Underwriting is each insurer's decision, made on that insurer's own application. For coverage questions talk to a licensed broker; for security work, to your IT or security lead.

What this does not cover. The 50 controls here are a small-business subset. They cite 11 of CISA's 34 CPG 2.0 goals; the other 23 goals are not asked about at all, so a high percentage on this page is a score against the subset and not against CPG 2.0. It is also not a reading of any insurer's application, which will ask its own questions in its own words. The full checklist lists which goal each control cites, and the report itself is linked under Sources.

How the score works, as the app computes it: each control has a weight of 1, 2 or 3. Yes earns the full weight, Partial earns half, No and unanswered earn nothing. The score is the weighted total as a percent, rounded. Gaps are listed heaviest first. It runs in your browser, stores nothing and sends nothing. The result is a self-reported estimate of where you stand; it says nothing about whether any insurer will offer coverage or at what terms.

Gaps to close next, heaviest first

Sources

CISA, Cross-Sector Cybersecurity Performance Goals (CPG 2.0), the official listing.
CISA, Cross-Sector Cybersecurity Performance Goals, Version 2.0 (PDF report). The goal codes and titles on these pages are the report's, 34 goals, retrieved 2026-10-02. CISA's web listing words a few goals differently from the report; the report's wording is used here.
Where a control also cites NIST Cybersecurity Framework 2.0, CIS Critical Security Controls v8 or an FBI IC3 report, that reference is shown on the control as the app records it.

Keep track of it

About the PolicyReady app

PolicyReady is an app that walks a small business through these same controls, ranks the gaps and exports a readiness summary. This page is a free, no-signup version of the idea; nothing here is sent anywhere.

PolicyReady is not released. It is in App Store review as of 2026-10-13, so you cannot install it yet. This page works now and does not need it.