Understand the condition of your information security program

The Trust Assessment is a short, focused review of how your business currently approaches information security and where action will benefit the most. It provides orientation and confidence for decision making.

A Trust Assessment looks at how information security actually shows up in day-to-day operations and what level of confidence that supports.

The Trust Assessment

A Trust Assessment is an evaluation to understand the business context, current practices, and the priorities that matter most right now.

It looks at how information security shows up in day-to-day operations across people, process, proof, and partners. The goal is not to score or audit, but to understand what is in place today and what level of confidence that supports.

This provides a clear, low effort starting point for deciding what matters most next, whether that means taking no further action or moving forward deliberately.

The assessment provides:

• an indication of current program maturity
• clarity on immediate priorities
• an understanding of gaps and risks
• an informed basis for deciding next steps

A Trust Assessment looks at observable practices and behaviours across people, process, proof, and partners, using a maturity scale to show where things are stable, emerging, or still informal.

The goal is to establish a clear baseline and support better decisions.

What it covers

The assessment typically considers:

• how information security shows up in day-to-day operations
• how clearly roles, routines, and expectations are defined
• how consistently key practices are followed
• what evidence exists to support decisions
• how external partners affect trust and risk

How it works

The assessment uses a maturity matrix to show how each area of the program currently operates, from early and reactive through to stable and resilient.

The assessment is completed through guided self-reflection, supported by discussion and interpretation.

This assessment focuses on understanding where you are today, not what is intended or documented.

What you get

• a clear view of your current trust and maturity position
• insight into strengths and opportunities
• prioritized areas for improvement
• a shared language for discussing information security posture

The assessment is designed to be useful on its own, even if no further work follows.

What it is not

• not a compliance audit
• not a certification exercise
• not a risk assessment
• not a sales pitch

A risk assessment is a separate step and is often more effective once priorities are clear.

What happens next

After the assessment, you’ll have a clearer view of your current position and options.

For some businesses, that’s enough. For others, it becomes the foundation for a targeted risk assessment or program development work.

No obligation. The assessment is designed to be useful on its own, even if no further work follows.