- Company
- Example Company SA, 12 people, Vaud
- Level
- Advanced: 37 points, nine domains
- Report
- Kadenz Advanced, excerpt
- Basis
- Guided questionnaire and documents provided
In brief
45 out of 100Priority
Overall score: 45 out of 100, reading “priorities to tackle first”. The score is a priority marker, not a compliance grade.
What is in place: workstations and the network are the strongest domains.
What exposes the company: no backup copy outside the main site, no restore ever tested, no written plan for an incident.
Score per domain
75 and above: solid. 50 to 74: to strengthen. Below 50: priority. The score comes from a fixed formula, the same for every company: each point weighs 1, 2 or 3 depending on its importance.
| Domain | Score | |
|---|---|---|
| IT governance4 points assessed | 63 | To strengthen |
| Identity and access4 points assessed | 41 | Priority |
| Backup and recovery4 points assessed | 27 | Priority |
| Workstations and servers4 points assessed | 80 | Solid |
| Network and remote access4 points assessed | 72 | To strengthen |
| Email and awareness5 points assessed | 50 | To strengthen |
| Data protection (nFADP)4 points assessed | 28 | Priority |
| Suppliers and cloud4 points assessed | 28 | Priority |
| Incidents and continuity4 points assessed | 13 | Priority |
Your five main risks
The five highest weighted gaps, explained in plain language.
Domain : Backup and recovery
No copy of the data outside the main site
If ransomware or a disaster hits the premises, the backups disappear along with everything else.
Do first Set up an off-site or offline copy, protected against deletion.
Effort Medium
Domain : Backup and recovery
No restore has ever been tested
A backup that has never been restored may turn out to be unusable on the day it is needed.
Do first Restore a test folder and note how long it takes.
Effort Low
Domain : Incidents and continuity
No written plan for an incident
Without a plan, everyone improvises: who decides, who tells the customers, who calls the provider?
Do first Write one page: who does what, who to inform, in which order.
Effort Low
Domain : Identity and access
Access rights are never reviewed
Over the years, people keep access they no longer need.
Do first List the administrators and remove unneeded access.
Effort Low
Domain : Backup and recovery
Recovery time and acceptable data loss not defined
Without these two benchmarks, nobody knows how long the company can be down or how much data it can lose.
Do first Agree with management a recovery time and a maximum acceptable data loss.
Effort Medium
Roadmap: excerpt
Excerpt of the plan: the full report ranks all the gaps.
30 days
- Restore a test folder and note the time it takes.
- Write the one-page incident plan.
60 days
- Set up an off-site copy protected against deletion.
- Review access rights and the list of administrators.
90 days
- Agree recovery time and acceptable data loss with management.
- Keep the record of personal-data processing (nFADP).
Going further
Only one follow-on is suggested, the one that matches the main risks: here, a backup audit with a real restore test.
What this is not
An orientation check based on the information provided. It is not an audit, a certification, legal advice or a penetration test; we do not guarantee any result. The score is a priority marker.