Security controls matrix

7 customers × 68 controls · average 72% · 7 with critical gaps · 102 stale assessments

Control library not migrated. This database has no control library, so the 68 controls below are being served from the copy bundled into the Worker (src/data/fallback.ts), generated from the migrations themselves. Apply the migrations and this banner disappears: CLOUDFLARE_API_TOKEN=… ./scripts/migrate-remote.sh

Sort name score critical gaps

Customer	Score	Crit	Fresh	Identity & Access								Endpoint Security								Microsoft 365 / Cloud									Email Security						Backup & Recovery							Vulnerability & Patch						Network Security									Monitoring & Detection							Governance
Customer	Score	Crit	Fresh	01	02	03	04	05	06	07	08	01	02	03	04	05	06	07	08	01	02	03	04	05	06	07	08	09	01	02	03	04	05	06	01	02	03	04	05	06	07	01	02	03	04	05	06	01	02	03	04	05	06	07	08	09	01	02	03	04	05	06	07	01	02	03	04	05	06	07	08
Example Accounting Partners 19 users	92%	2	78%
Example Engineering Group 118 users	73%	6	82%
Example Legal Services 26 users	86%	3	78%
Example Logistics 74 users	64%	7	77%
Example Medical Practice 42 users	92%	2	82%
Example Not-For-Profit 12 users	47%	12	85%
Example Retail Group 210 users	52%	9	68%

Legend

Implemented 100Partially Implemented 50Pending 25Not Implemented 0Unknown 0Exception Accepted excludedNot Applicable excluded hatched = stale not assessed

Scoring follows docs/scoring.md: Σ(weight × status score) ÷ Σ(weight), with not_applicable and exception_accepted excluded from both sides. Critical gaps are counted separately and never averaged away. Authentication arrives at M2 — until then this page is unauthenticated, which is why it holds no real customer data.