Assessments / CTEM Maturity Assessment
CTEM Maturity Assessment
Twenty questions, four per Gartner CTEM stage, one at a time. Go back to change an earlier answer whenever you like — everything is scored live in your browser, nothing is uploaded.
How is the scope of what you protect defined?
0 / 20 answered
Answer at least one question in every stage to see gap-specific findings.
// About this tool
CTEM Maturity Assessment
Continuous Threat Exposure Management (CTEM) is Gartner's five-stage framework for reducing security exposure: Scoping, Discovery, Prioritization, Validation, and Mobilization. This tool asks four questions per stage — twenty total — and scores where your program actually stands on each one, ending with a synthesized recommendation for your single highest-leverage next step.
This is an informal practitioner self-check, not official Gartner methodology or a substitute for a real maturity audit. It's meant to surface which stage is dragging the rest of the cycle down, fast, so you know where to look first.
Everything runs in your browser. Your answers are never uploaded or stored anywhere — refresh the page and the assessment resets.
// When to use it
Get a baseline before writing a CTEM program charter
Run the assessment before scoping a new exposure-management initiative, so the charter targets your program's actual weakest stage instead of a guess.
Spot which stage is dragging the program down
Most CTEM programs fail quietly at Validation or Mobilization, not Scoping or Discovery. The per-stage breakdown shows exactly where that is for you.
Use it as a discussion starter with stakeholders
Copy the results as Markdown and drop them into a doc or ticket to anchor a conversation about where to invest next.
// Questions
Is this official Gartner CTEM methodology?
No. It's an informal self-check inspired by the publicly described CTEM framework, built for a quick gut-check — not a substitute for Gartner's own research or a formal maturity assessment.
Are my answers stored or uploaded anywhere?
No. Scoring happens entirely in your browser via JavaScript. Nothing is sent to a server, and nothing persists — reloading the page clears your answers.
What do the maturity tiers mean?
Each stage averages its four answers into a 0-3 score, mapped to four tiers: Ad hoc (0-0.74), Developing (0.75-1.49), Defined (1.5-2.24), and Managed (2.25-3) — roughly, whether the activity happens at all, happens informally, happens on a defined process, or happens continuously.
Can I retake it?
Yes — answers aren't saved, so you can change any answer or start over at any time.
// Related tools