The value of this assessment comes entirely from answering it as things actually are, rather than as they are meant to be. It is designed to be filled in privately before it is discussed with anyone.
Who should answer it
One person can complete it, but the answers get sharper with three: whoever owns mobile security, whoever owns the app itself, and whoever would be called at two in the morning if something went wrong. Where those three give different answers to the same question, that disagreement is the finding.
How scoring works
| Answer | Score | Means |
|---|---|---|
| Yes | 2 | You could demonstrate this today, on request, without preparation |
| Partly | 1 | True for some apps, or true in principle but never tested |
| No or unsure | 0 | Not in place, or nobody present knows |
Score “unsure” as zero. If the answer cannot be found quickly by the people in the room, it is not available at the moment an incident happens either. Four questions are marked critical: a zero on any of them matters more than your total, because each describes an exposure the other nineteen answers cannot compensate for.
The six sections
What your score means
| Score | Where you stand |
|---|---|
| 32 to 40 | Strong coverage. Remaining risk is drift rather than absence. Re-run every six months. |
| 22 to 31 | Partial coverage, usually strong on detection and weak on evidence and integrity. The most common profile among organisations that already bought something. |
| 12 to 21 | Significant gaps, typically a single technique doing one job well and nothing else. Assess your highest-risk app before buying one more product. |
| 0 to 11 | Effectively unprotected at the device layer. A weeks problem, not a years problem, if deployment does not require code changes. |
Five gaps this usually exposes
- Detection without reporting. The app blocks something, decides locally and tells nobody. The control works and the organisation learns nothing from it.
- Protection nobody has tried to remove. Question 5 most often gets a long pause. Vendors are rarely asked to demonstrate it, so it is rarely tested.
- One policy for every app. Deployed once, tuned never. Support tickets on low-risk apps create the pressure that weakens protection on high-risk ones.
- An unmeasured false-positive rate. Nobody knows it, so nobody defends it, and the first product-owner complaint wins by default.
- Apps nobody counted. A subsidiary’s app, a campaign app, an app inherited in an acquisition. They carry your name and your regulatory exposure.
The full assessment includes all twenty questions with the reasoning behind each, the scoring sheet, and a set of follow-up questions to take to your current vendor, each answerable in a live session rather than a document. Download it below.
