Score it yourself

How well is access managed where you work?

10 questions, 5 minutes. Your score builds as you answer. At the end, your full report opens in a new tab.

Think of your weakest site

Not your best one. The site you'd least like to see audited shows where the real risk is.

Not sure? Pick the lower answer

If the honest answer is "it depends", the lower option is usually closer to the truth.

"We don't know" is useful

It's often the most helpful answer on the page, because it shows you where to start.

Across all your systems and sites

Seeing who has access

Question 1

Q01An auditor asks who can open the server room door today, and why. How long until you have the answer?

3 · Less than an hour2 · About a day, pulling lists from several systems1 · Several days of manual work0 · Honestly, we couldn't say for sure

Question 2

Q02How many different access control systems do your sites use?

3 · 1, or several that we manage from 1 place2 · 2 or 3, each managed on its own1 · 4 to 90 · 10 or more, or we're not sure

The people who don't work for you

Contractors and visitors

Question 3

Q03How do contractors and agency staff get access approved?

3 · In a workflow, with a named approver and an end date2 · In a system, but the end date is optional1 · By email or a form, typed in by the security desk0 · Each site does it its own way, with no central record

Question 4

Q04Before a contractor gets a badge, are their certificates and insurance checked?

3 · Yes, automatically: no valid documents, no badge2 · Yes, by hand, before the badge is issued1 · At the gate, when they first arrive0 · Not always

Leavers, movers and temporary access

Taking access away

Question 5

Q05When someone leaves or changes job, how fast is their access closed everywhere?

3 · The same day, automatically2 · Within a few days, by someone who owns the task1 · It can take weeks, depending on who remembers0 · We sometimes find access still open for people who left

Question 6

Q06When access is given for a temporary reason, does it end by itself?

3 · Always, access has an end date by default2 · Sometimes, if the requester fills in a date1 · Rarely, most access stays open0 · No

The cards people carry today

Your badges

Question 7

Q07What kind of badges do people use on your sites today?

3 · MIFARE DESFire EV3, with keys we control2 · MIFARE DESFire EV2, or another current secure technology, with keys we control1 · Mostly older ones: MIFARE Classic, LEGIC prime or 125 kHz0 · Readers that only read the card number, or we're not sure

Question 8

Q08If every badge had to move to newer technology, how would you do it?

3 · Automatically, with a badge that carries both technologies2 · We have a plan, but it's manual and will take a long time1 · No plan yet, it would be a big manual campaign0 · We keep postponing it because it's too disruptive

What you can show, and what you control

Proof and keys

Question 9

Q09Where are the keys that protect your badges kept?

3 · With us, in a secure module we control2 · With us on paper, but a supplier runs it day to day1 · With our installer or badge supplier0 · We don't know

Question 10

Q10When someone leaves, how sure are you that their badge came back and was switched off?

3 · Very sure, both are recorded for each person2 · It's switched off, but we don't track whether it came back1 · We ask for it back, but don't follow up0 · We don't have a reliable way

0 / 30

Answer the questions above to see your score.

The results

What your score means

25 to 30

In control

Access is a managed process, and you can prove it. What's left is making it easier.

18 to 24

Mostly in control, with gaps

The basics are there, but some of it depends on people remembering.

10 to 17

At risk

Giving access works well. Taking it away doesn't. An audit would find issues.

0 to 9

Not in control yet

Nobody can say for sure who can get in. That's common, and rarely anyone's fault.

Questions

Frequently asked questions

Is anything sent to Axxession when I take this?

No. Everything happens in your browser: your answers, your score and your report. Nothing is sent to us unless you contact us yourself.

What is in the report?

Your score, what it means, and where your points went across the 5 areas. Then the 3 answers worth starting with, each with why it matters and a first step. The advice is useful whether or not you ever talk to us.

How should I answer if I am not sure?

Answer for the site you would least like to see audited, not your best one. If the honest answer is 'it depends', pick the lower option.

What does a score in the middle mean?

Most organisations score somewhere in the middle, and almost never through negligence. It is what happens when access systems are added 1 site at a time over many years.

The first step

Start with 1 site and 1 population.

You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.

Book a 45-minute conversation Score your access governance

One siteOne populationYour readers stay