Cybervize
Assessment module in the OdySecure security platform from Cybervize

Assessment software for the security maturity of your plants and sites

One questionnaire across every plant, the results in a group dashboard. The difference is in the filling in: the module searches the documents you hold and offers the matching passages, with their source, as suggestions. And it tells you where nothing is documented. Official snapshots are immutable, hosting in Germany.

Book a free demo

What sets the Assessment module apart

Nobody should retype what is already documented

What costs time is not the questionnaire, it is the searching. The answers already sit in policies, concepts and audit reports, just not in the questionnaire. The Assessment module pulls them out of there and puts them in front of you.

Suggestions from your own documents

Opening a question searches the documents you are cleared to read and shows the matching passages with their source. One click adopts a passage into the answer field, where you can still edit it; nothing is stored until you save. No text is composed along the way, the module searches and shows. A human sets the answer.

Where nothing is written, it says so

„Nothing in your documents matches this question" is the finding that counts: your gap evidence. The coverage preview for a whole unit is built from it, and that runs across every question rather than a sample. A technical failure is a separate, third state and never counts as a gap.

The second round does not start from zero

In a follow-up round the module proposes the answers from the previous run. They arrive as a suggestion, not as an answer: the answer field stays empty until someone confirms. You decide whether a question or a whole block may be prefilled, and the source run is recorded in the audit trail.

Book a free demo

Which documents someone can search is decided by the server from their permissions, never by the request: whoever is responsible for one plant sees only that plant's documents. And before a question is evaluated, the system checks that the data residency agreed with you is being kept.

What the Assessment module looks like

Captures from the platform, taken from one completed assessment across five plants.

Site comparison in the Assessment module: five plants with maturity from 6.5 down to 3.3 out of 7
Site comparison: the maturity of every plant at a glance, from 6.5 down to 3.3 out of 7.
Site heatmap in the Assessment module: five plants across the four themes organisational, people, physical and technological
The heatmap shows per plant where things stall, down to the individual theme.

No CISO of your own?

In a vCISO mandate, your vCISO works with OdySecure and the platform is included. From €3,600/month.

Book an intro call vCISO in detail
More about the assessment module

What the Assessment module covers

The Assessment module measures your organisation's maturity against recognised standards or your own catalogues. No Excel round-robins, no manual slide consolidation.

Group dashboard with heatmap

All sites, plants and business units as colour-coded tiles, from critical to compliant. Scores aggregate along your organisational structure: the plant score feeds the country score, which feeds the group score. With site comparison and trends across collection waves.

Data collections across all sites

One assessment wave instead of separate runs per site: select the target units and each automatically receives its own assessment run. Real-time progress across all units, binding deadlines, automatic flagging of units without a current state after 45 days.

Frameworks and custom questionnaires

Bundled standards or your own catalogues with configurable questions, weighting and requirement levels MUST, SHOULD, MAY. Import further catalogues in OSCAL format directly from GitHub.

Owner cockpit with delegation

Site owners see progress, open questions and days remaining until the deadline. Specialist questions can be delegated to experts, answers from the parent unit are inherited and only adapted locally.

Official states with approval

A snapshot freezes answers, scores and evidence references; the system checks mandatory questions and mandatory evidence first. Once approved, a state is immutable. The diff view shows what changed since the last official state.

Evidence, scoring and export

Evidence documents with versioning and retention periods, three scoring models from weighted scale to maturity levels, reports as PDF, Excel or a complete package with evidence directory. Actions are recorded in the audit trail.

Standards and catalogues in the Assessment module

Recognised frameworks as the foundation, custom catalogues where needed. New frameworks are data maintenance, not custom development.

  • IEC 62443 for industrial automation: maturity assessment with Security Level 1 to 4, overall score by minimum rule
  • NIST SP 800-53 Rev. 4 and 5 with Low, Moderate and High baselines
  • BSI Grundschutz++: user catalogues from the state-of-the-art library
  • DIN SPEC 27076: the German SME standard, interview-based with additive scoring
  • OSCAL import: read control catalogues in the machine-readable standard format directly from GitHub
  • Custom questionnaires with question types from yes/no to interview and matrix, weighting per question
50frameworks as a catalogue in the platform:standards and frameworks, regulatory requirements, requirement records per entry.See the full list

Self-assessment or guided: you choose the path

The module is built for independent use. If you want an outside perspective, you get it on the same platform.

Self-assessment with your own team

Your team runs assessments independently: pick a catalogue, start a data collection, sites answer, results show up in the group dashboard. Suited for organisations with their own CISO or security team.

Book a free demo

Guided assessment with Cybervize

Cybervize experts run the assessment on the platform, moderate the interviews and deliver the results report with a measure list. Afterwards you can continue operating the platform yourself. If you wish, a vCISO takes the measure list forward.

See the guided assessment

Who the Assessment module is built for

Three constellations in which the module replaces Excel round-robins and manual slide consolidation.

Group CISO with multiple plants

Responsible for IT and OT security across many plants, needs a reliable maturity level per site instead of gut feeling. Data collections across all plants, IEC 62443 maturity levels, site comparison and trends in the group dashboard.

Mid-market before ISO 27001 or NIS-2

Needs an honest picture first: where do we stand, what is missing? Gap assessment based on DIN SPEC 27076 or a custom catalogue as the starting point. From identified gaps you create measures in the ISMS module with one click.

Site and OT owners

Answer their questionnaire in the owner cockpit, delegate specialist questions to experts at the plant and inherit central answers. Visible is only what their role needs.

FAQ about the Assessment module

What happens to the documents the module searches?▼
They stay where they are: in your own area of the platform, hosted in Germany. Which documents someone can search is decided by the server from their permissions, not by the request; whoever is responsible for one plant sees only that plant's documents. Before a question is evaluated, the system checks that the data residency agreed with you is being kept. And the preview composes nothing: it finds the matching passages and shows them with their source, a human sets the answer.
What is the difference between self-assessment and guided assessment?▼
In a self-assessment your team works independently with the module: bundled standards or custom catalogues, data collections across sites, evaluation in the group dashboard. In a guided assessment, Cybervize experts run the evaluation on the same platform and deliver the results report with a measure list. Both paths use the same data layer, switching is possible at any time.
Which standards are included in the Assessment module?▼
Bundled are NIST SP 800-53 (Rev. 4 and 5 with baselines), BSI Grundschutz++, IEC 62443 with maturity scoring and DIN SPEC 27076 for SMEs. Further catalogues can be imported in OSCAL format directly from GitHub or built as custom questionnaires with weighting and requirement levels.
How does an assessment across many sites work?▼
You start a data collection and select the target units; the system creates a separate assessment run for each unit, including sub-units. Answers from the parent unit can be inherited, sites only adapt local deviations. For aggregation to the group score you choose between weighted average, simple average and the minimum rule, where the weakest link determines the overall score.
What is an official state and what is it for?▼
An official state is a frozen, approved snapshot of all answers, scores and evidence references. Before creation, the system checks that all mandatory questions are answered and all mandatory evidence is uploaded. Once approved, the state is immutable and serves as an audit-proof record for internal and external audits. The diff view shows what changed between two states.
What does the AI do in the Assessment module and where are its limits?▼
For each question you can request an AI pre-assessment: a suggested rating with reasoning and confidence. It is triggered manually, never automatically, and the decision stays with a person. AI results are never exported into official states. The LLM provider is configurable, including a self-hosted model via Ollama, so customer data does not have to leave your own network.
Can we start with the Assessment module alone?▼
Yes. Licensing is modular and the Assessment module runs on its own. Many organisations start with a maturity assessment and add ISMS or BCM later. The results are already in the platform, identified gaps are turned into measures with one click.

Assessment is one module of OdySecure

The Assessment module shares the data layer, permission model and audit trail with the ISMS (ISO 27001), BCM (ISO 22301) and TPRM modules. From identified gaps you create ISMS measures with one click, assessment results feed the risk picture. Licensing is modular: you can start with the Assessment module and extend when needed.

See the full platform

Memberships, programmes and partnerships

  • BSI Allianz für Cyber-Sicherheit
  • CISPA Helmholtz-Zentrum für Informationssicherheit
  • TeleTrusT - Bundesverband IT-Sicherheit
  • IT Security Made in Germany - TeleTrusT