Baseline walkthrough
Each control explained.
National Cyber Security Baseline Self-Assessment
A National Cyber Security Baseline self-assessment measures an organisation's controls against NACSA's minimum baseline, with the evidence behind each answer checked. NACSA's National Cyber Security Baseline sets minimum controls, and Directive No. 4 requires self-assessment against it. We facilitate the assessment, check the evidence behind each answer, and give you an honest score and a plan.
National Cyber Security Baseline Assessment
What it is
A facilitated self-assessment against the National Cyber Security Baseline, with evidence review and a remediation plan.
Why organisations need it
NACSA has published the National Cyber Security Baseline and a self-assessment tool, and Chief Executive Directive No. 4 addresses self-assessment against it. NCII entities are expected to use it, and increasingly ask their suppliers the same questions. A self-assessment without evidence gives a flattering score that will not survive an audit.
What the engagement covers
Evidence review
Documents and settings behind each answer.
Scoring
An honest baseline score.
Gap analysis
Missing and weak controls.
Remediation plan
Prioritised actions.
Supplier responses
Using the result to answer customer questionnaires.
What the business gets out of it
Honest score
Backed by evidence.
NACSA-aligned
Uses the national baseline.
Supplier advantage
Answer NCII customers confidently.
Clear plan
What to fix first.
Mid-level effort
No intrusive testing.
How it works
How the engagement runs
01
Kick-off
Scope and contacts.
02
Walkthrough
Controls reviewed with your team.
03
Evidence
Documents and settings checked.
04
Scoring
Baseline score.
05
Report
Gaps and plan.
Deliverables
What you receive
Baseline assessment
Completed and evidenced.
Score summary
By domain.
Gap list
Missing and weak controls.
Remediation plan
Prioritised.
Supplier response pack
For customer questionnaires.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
NACSA addresses self-assessment against the baseline in Chief Executive Directive No. 4 for NCII-related parties. Organisations outside that group use the baseline as a recognised national benchmark, and increasingly because their NCII customers ask about it.
Yes. NCII customers increasingly ask their suppliers the same baseline questions they must answer themselves. An evidenced self-assessment lets you answer those questionnaires quickly and honestly, and shows where to improve before a customer finds the gap.
We review evidence and settings behind each answer, such as configurations, records and policies, rather than accepting a yes at face value. We do not perform intrusive testing, so the assessment does not disrupt your systems.
Typically two to four weeks: a facilitated self-assessment session, an evidence review against each control, then a score and a remediation plan. The time depends mostly on how quickly evidence can be gathered.
The current version of the National Cyber Security Baseline that NACSA publishes, confirmed at kick-off. If NACSA updates the baseline during the engagement, we tell you what changed and how it affects your score.