Skip to content
HUMANWALL

Mission 30

The HUMANWALL Posture Assessment and Continuous Improvement Model

The HUMANWALL Posture Assessment is an illustrative self-assessment across ten domains on a simple 0–4 maturity scale. It helps you see where you stand, spot high-impact gaps and choose what to improve next, then repeat the cycle every quarter.

16 minutesHUMANWALL ChampionJump to scenario & quiz ↓

In this mission you will

  • Explain the five levels of the HUMANWALL maturity scale and the evidence each one needs.
  • Name the ten posture domains and apply the assessment honestly to your own business.
  • Use N/A correctly and explain how it affects the total.
  • Prioritise high-impact gaps regardless of the overall score and plan a regular reassessment.

From one-off effort to a habit

You have now worked through people, processes and technology across 29 missions. The last step is knowing where you stand and how to keep improving. The HUMANWALL Posture Assessment gives you a consistent way to look at your business across ten areas, pick your priorities and check progress over time. It is a prioritisation aid. It is not a certified HUMANWALL rating, a legal compliance determination, an audit, a penetration test or an estimate of how likely you are to be attacked.

The maturity scale: 0 to 4

  • 0 — Not established: no repeatable control is known to exist.
  • 1 — Ad hoc: actions happen, but inconsistently.
  • 2 — Defined: a documented approach and an owner exist.
  • 3 — Implemented and verified: in use, with appropriate evidence.
  • 4 — Measured and improving: results are monitored and used to improve.

The ten domains

  • Governance and ownership
  • Asset and data inventory
  • Identity and access management
  • Endpoint, software and patch hygiene
  • Email, web and communication security
  • Cloud, network and remote access
  • Data protection and privacy
  • Backup, continuity and recovery
  • Incident response and reporting
  • Awareness, third-party risk and continuous improvement

Reading your result

Each domain scores 0 to 4, so ten domains give a total out of 40. If a domain genuinely does not apply to your scope, you can mark it N/A, but only with a written reason, for example “no cloud or remote access is used in this branch”. N/A removes that domain from the total, so the denominator becomes smaller rather than counting as zero. Use it rarely and honestly; marking hard areas N/A only hides gaps. Your result also depends on the scope you chose, such as one site or the whole business, and on how honest the answers are.

The continuous improvement cycle

  1. 1Assess: complete the baseline with a second person who can challenge the answers.
  2. 2Prioritise: list high-impact gaps first, then pick up to three other priorities.
  3. 3Act: add each priority to your action tracker with an owner, due date and evidence.
  4. 4Verify: check that the fix works, for example with a restore test or access review.
  5. 5Reassess: repeat the assessment every quarter and after major changes, such as a new system, a new office, a merger, a key person leaving or an incident.
  6. 6Compare: look at the trend, not just the number, and celebrate real progress.

Practical business example

Mehta Electricals scores 32 out of 40

Mehta Electricals, a fictional 50-person wholesale distributor in Ahmedabad, completed its first posture assessment. The owner, Nikhil, was pleased: 32 out of 40. Most domains were at 3 or 4. But his operations head, Farah, who reviewed the answers with him, noticed something. Backup, continuity and recovery scored 1. Backups ran for some data, but the billing system had never been restored, and nobody knew how long it would take. Farah pointed out that this was a high-impact gap. Without billing, the business could not invoice or dispatch. Nikhil agreed to treat it as the top priority. Farah became the owner, the IT vendor set a restore-test date three weeks out, and they agreed how quickly billing needed to be back. The test took far longer than expected, so they improved the process and tested again. At the next quarterly reassessment, backup moved to 3.

The lesson: A high total can hide a dangerous gap. Looking at high-impact domains first, with a reviewer who can challenge answers, turned a comfortable number into a real improvement.

Key takeaways

  • Use the 0–4 scale consistently: not established, ad hoc, defined, implemented and verified, measured and improving.
  • Score what you can show with evidence, not what you intend; when unsure, choose the lower level.
  • N/A needs a written reason and changes the denominator, so use it rarely and honestly.
  • Address high-impact gaps in identity, email, backup and incident response first, regardless of the total.
  • Reassess every quarter and after major changes. The result is an illustrative self-assessment, not certification, audit, compliance or a prediction of attack.

Scenario lab · +25 XP

A good score with a hidden gap

You are helping Sunrise Dairy Products, a fictional 40-person dairy processor near Nashik, review its first HUMANWALL Posture Assessment. The owner, Kavita, scored the business 30 out of 36, with Cloud, network and remote access marked N/A. Incident response and reporting scored 1: there is no reporting channel or contact card. Kavita says, “We are above 80 per cent. Surely we are fine.”

Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.

Decision 1 of 3

How do you respond to Kavita’s view of the score?

Knowledge check · +20 XP on mastery

Check your understanding

1. What does level 4 mean on the HUMANWALL maturity scale?
2. A business scores 34 out of 40 but scores 0 for backup, continuity and recovery. What should it do?
3. What happens when a domain is correctly marked N/A?
4. Which statement about the HUMANWALL Posture Assessment result is accurate?

Practical action · +40 XP (self-reported)

Complete your baseline and plan the next cycle

Complete the HUMANWALL Posture Assessment for a clearly defined scope, with a reviewer. Record levels and general evidence descriptions only. Do not record passwords, account numbers, customer data or details that would help an attacker.

  1. 1.Choose your scope, such as the whole business or one site, and write it down.
  2. 2.With a reviewer, score each of the ten domains from 0 to 4, noting the evidence for any score of 3 or 4.
  3. 3.Mark a domain N/A only if it genuinely does not apply, and record the reason.
  4. 4.List every high-impact domain that scores 0 or 1 and assign an owner and due date to each.
  5. 5.Choose up to three further priority gaps and add them to your 90-day action tracker.
  6. 6.Book your next reassessment for three months from now, and agree to reassess sooner after any major change.

Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.

Mission status: Not started

A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.

View my progress