Cyber Exposure Brief — ERMITS Advisory

Step 1

Organization context

Choose the minimum context first. Sector drives defaults. Role drives language, prioritization, and report emphasis.

Organization name

Primary geography

Sector

Organization size

Primary role completing assessment

Cross-border data transfers

Step 2

Critical operations, assets, and data

Defaults load automatically from sector. Keep the ones that apply, deselect what doesn't, and add any missing items.

Critical functions

Critical assets / platforms

Sensitive data types

Step 3

Vendor ecosystem

Low-friction vendor intake. Sector preloads likely vendor categories. Tag only those that materially affect continuity.

Number of critical vendors

Core services outsourced

Alternate provider available for core services

Likely vendor categories in scope

Step 4

Ransomware readiness

Intentionally short. These five indicators materially drive the security gap score and inform the 72-hour action priorities.

Step 5

Privacy and regulatory posture

These governance indicators determine how quickly a technical incident escalates into a regulatory and legal crisis. Questions are calibrated to your selected geography.