About Your Organization

Takes about 2 minutes. Personalizes priority scores in your gap optimization and assessments.

A note from our review team:

For additional information, please follow up with support@frameworkmapper.com.

Profile Active Environment questions pending

Organization

Industry Vertical: —
Organization Size: —
IT Staff: —
Security Staff: —
Annual Security Budget: —
Resource Profile: —

Technology Environment

These questions aren't answered yet

Your priority scores are running without any environment signal, so the values below are placeholders rather than your answers. Telling us about your cloud, workforce, and data takes about a minute and tunes every recommendation to your actual setup.

Cloud Environments: —
Workforce: —
Operational Technology: —

Data & Exposure

Sensitive Data Types: —
Internet-Facing Systems: —
Third-Party Vendor Connections: —
Email Platform: —
Identity Provider: —

Last updated: —

Step 1 of 2 — Organization

Industry Vertical *

Your industry vertical is set and cannot be changed. Contact support if it needs to be corrected.

Organization Size *

IT Staff Count *

Dedicated IT employees (FTE)

Security Staff Count *

Dedicated security roles (FTE)

Annual Security Budget *

Used to auto-select your resource profile (minimal / moderate / well-resourced)

Cloud Environments

Select every cloud model your organization uses. These signals affect how controls related to cloud configuration, identity, and data protection are weighted in your priority scores.

Cloud Infrastructure (IaaS)

You rent virtual machines, storage, or networking from a provider (e.g. AWS EC2, Azure VMs, Google Compute Engine). You manage the OS and everything above it.

Cloud Platforms (PaaS)

You deploy applications on a managed platform without managing the underlying servers (e.g. Azure App Service, AWS Elastic Beanstalk, Google App Engine, Heroku).

Cloud Applications (SaaS)

You use software hosted and managed entirely by a vendor (e.g. Microsoft 365, Google Workspace, Salesforce, Slack, Zoom). Most organizations use at least one SaaS product.

Workforce

How your staff works affects your exposure to phishing, credential theft, and endpoint risks. Remote and hybrid environments require stronger identity and device controls.

What portion of your staff works remotely?

Personal Devices (BYOD)

Employees use their own phones, laptops, or tablets to access work email, files, or systems. BYOD significantly increases endpoint and data loss risk.

Operational Technology

OT and industrial IoT systems are often unpatched, always-on, and safety-critical — they require a different set of security controls than standard IT environments.

OT / Industrial IoT (OT/IIoT)

You operate industrial control systems, building automation, medical equipment, or manufacturing systems connected to your network (e.g. SCADA, PLCs, HVAC controllers, infusion pumps).

Briefly describe your OT/IoT environment (optional)

Sensitive Data Types

Check every data type your organization stores, processes, or transmits. Each type activates specific regulatory controls and raises the stakes for certain security failures.

PII — Personal Information

Names, addresses, Social Security numbers, dates of birth, or any data that can identify a specific person.

PHI — Protected Health Information

Medical records, diagnoses, treatment history, insurance information, or any health data tied to an individual. Triggers HIPAA requirements.

CUI — Controlled Unclassified Information

Sensitive government information that is not classified but requires safeguarding. Required for CMMC compliance.

FCI — Federal Contract Information

Information provided by or generated for the U.S. government under a contract.

Financial / Payment Data

Credit card numbers, bank account information, payment processing records, or financial account data.

Student Records (FERPA)

Education records including grades, transcripts, enrollment status, and financial aid information for students at any level.

Exposure

External-facing systems and third-party connections are among the most common attack entry points. These signals significantly increase the weight on perimeter and supply-chain controls.

Internet-Facing Systems

You operate websites, portals, APIs, remote access services (VPN, RDP), or any system directly reachable from the public internet.

Third-Party / Vendor Connections

How many external vendors, suppliers, or service providers have access to your systems, network, or data?

Identity & Email (optional)

Knowing your email and identity platforms helps tailor recommendations for phishing defense, MFA, and access management controls.

Email Platform

Identity Provider