10YEARS OF TRUST AND DELIVERY
Contact

First orientation / Self-assessment

VS-NfD Readiness Check

Understand the foundations for handling protected information before they become a delivery constraint.

Start the check
24 questions6 domainsNo registrationLocal browser results

Answer from your current operating reality. Select a positive answer only where you can support it with evidence. Every question is required.

Domain 01

Governance & Organisation

Ownership, documented responsibilities and an operating model for protected information.

01Is responsibility for VS-NfD handling formally assigned within the organisation?
02Are roles, responsibilities and escalation paths documented and understood?
03Is there a current organisational handbook or equivalent procedure set for VS-NfD handling?
04Are project-specific security requirements reviewed before work begins?

Domain 02

Personnel & Awareness

Access discipline, briefing, awareness and lifecycle control for involved personnel.

05Are personnel granted access strictly on a need-to-know basis?
06Are required briefings/instructions documented before access is granted?
07Is access removed or reviewed promptly when personnel leave or change roles?
08Is recurring awareness training provided for protected-information handling?

Domain 03

Information Handling

Identification, storage, transmission, reproduction, disposal and traceability.

09Are VS-NfD documents and data clearly identifiable throughout their lifecycle?
10Are approved storage locations and handling rules defined and enforced?
11Are transmission methods restricted to approved and controlled channels?
12Are printing, copying, retention and disposal processes defined and auditable?

Domain 04

IT & Secure Collaboration

Technical environments, access control, endpoint security and controlled collaboration.

13Is the IT environment used for VS-NfD work explicitly approved for the intended handling model?
14Are strong authentication and role-based access controls consistently enforced?
15Are endpoints, removable media and data transfers technically controlled?
16Are logging, monitoring and incident evidence capabilities sufficient for the environment?

Domain 05

Physical & Operational Security

Physical access, workspace controls, meetings and daily operating discipline.

17Are workspaces used for protected information access-controlled and appropriate for the activity?
18Are unattended documents, screens and removable media protected from unauthorised observation or access?
19Are meetings, visitors and external participants managed under defined security rules?
20Are deviations and security incidents reported through a known process?

Domain 06

Suppliers & Assurance

Third-party involvement, contractual controls and evidence that measures remain effective.

21Are suppliers/subcontractors assessed before receiving access to protected information?
22Are security requirements contractually passed down where necessary?
23Are external collaboration tools and service providers reviewed before use?
24Are controls periodically reviewed, tested or internally audited for continued effectiveness?

Initial orientation only. This check does not replace certification, accreditation, a security clearance, supplier approval, legal advice or a project-specific professional assessment.

How the result is calculated

Every question is equally weighted: No = 0, Partly = 1, Yes = 2. Total score = points received / maximum points, rounded to the nearest whole number. Domain scores use the same calculation. Original band thresholds are 40, 70 and 85. The three lowest-scoring domains form the priority list. This is the existing Artefaktum orientation model, not an authority-approved pass mark.

0-39: CRITICAL GAPS / 40-69: MATERIAL GAPS / 70-84: ADVANCED READINESS / 85-100: HIGH READINESS

All self-assessments
Confidential Consultation

Start a confidential conversation.

Share the essential context of your request.