Cybersecurity Diagnostic

An ISO 27001 certification audit is conducted by an independent accredited body and results in an official certificate. The Kaliteq diagnostic is an AI-assisted self-assessment: it issues no certification, but it objectively measures the gap with the standard's main domains and effectively prepares for a certification audit ahead of time.

No. The diagnostic assesses declared organizational and technical practices, while a penetration test actively exploits vulnerabilities within a specific technical scope. The two approaches are complementary: the diagnostic identifies risk areas, the pentest tests them under real conditions.

Yes. The answers, documents and reports generated belong to your organization and are neither shared nor used to train third-party models. A private, time-limited sharing link can be generated if you want to pass the results to a third party (insurer, client, investor).

Yes, that is in fact one of the most common use cases. The questions remain understandable without prior cybersecurity expertise, and the executive or IT director can answer alone, drawing on their IT vendors for the more technical aspects if needed.

The first recommendations appear as soon as a domain is completed and analyzed, without waiting for the full diagnostic to finish. Most users get an actionable first risk map within one or two working sessions.

The Cybersecurity Diagnostic includes around 137 questions across 21 domains, roughly 69 to 110 minutes for a first pass. Answers remain editable as long as the diagnostic has not been finalized.

The Cybersecurity Diagnostic covers the following domains: Réseau, pare-feu et VPN, Conformité fournisseurs, Conformité & RGPD, Continuité d'activité, Mobile & Télétravail, Plan de reprise, Identités et accès, Sécurité, Gestion des actifs, Gestion des vulnérabilités, Gouvernance cybersécurité, Sécurité des emails, Sécurité des serveurs, Sécurité opérationnelle, Sensibilisation des utilisateurs, Données & Sauvegardes, Chiffrement, Sécurité des développements & APIs, Cloud, Postes de travail & EDR, Journalisation & détection.

Typically, management answers the governance-related questions, while operational leads answer the questions in their domain (e.g. CISO or IT director for cybersecurity, CTO for development). Kaliteq lets you invite several contributors on the same diagnostic, each answering the domains that concern them.

The Cybersecurity Diagnostic is inspired by the main practice areas of CMMI v3 (governance, development, operations, cybersecurity, product…), to provide a pragmatic maturity diagnostic — without claiming official CMMI conformity.

At the end of the diagnostic, Kaliteq generates a report structured by domain: maturity level, identified strengths, risks prioritized by impact and remediation effort, and recommendations automatically turned into a tracked Progress Plan. The report is based exclusively on the answers provided and any associated documents, with full traceability to their source.

Yes. The Cybersecurity Diagnostic is rated "intermediaire" difficulty. Its intermediate level assumes operational knowledge of the domain being assessed, without requiring deep expertise. Kaliteq is designed for organizations of any size, with no dedicated team required to run the diagnostic.

The diagnostic covers all the domains an information security policy needs to document: security governance, identity and access management, vulnerability management, encryption, awareness, monitoring and continuity planning. The answers and the risk report provide a base that can be used directly to draft or update a security policy.