Platform
From framework questions to a scored risk register.
Choose a framework, answer its questions with your team, attach the evidence, and get an overall score, a list of issues and a set of risks. VectraIQ drafts the analysis and your expert team reviews it with you.
Completed Oct 2, 2026
ExampleAssessment-Q4-2026
Moderate Risk- Issues Logged
- 9
- Risks Identified
- 6
The score is how well your controls answered. The risk label reflects the risk that remains.
Before you start
Pick the framework. See the questions first.
Preview every question for a framework, and see roughly how long it will take, before anyone spends an hour on it.
Which frameworks are available, and what readiness involves for each, is on the frameworks page.
Two methods
- Traditional
- The framework’s standard question set, answered as written.
- VectraIQ
- Adds recommended questions chosen from your company profile, each with a line explaining why it was recommended. Available on frameworks marked VectraIQ compatible.
Setup
Four steps from framework to result.
Show the four steps
- 1
Choose the framework
Preview its questions first, and pick the standard or the VectraIQ-tailored question set.
- 2
Assign people
Respondents from your team, with your expert team joining as advisors.
- 3
Answer and attach evidence
Everyone answers in the platform and uploads the documents each question asks for. Progress is visible and anyone can pick up where they left off.
- 4
Review and complete
Your cyber expert reviews the results with you before the assessment is marked complete.
Evidence
Documents are checked, not just collected.
Some questions ask for a document. Each upload is checked against what that type of document should contain, and VectraIQ writes a short quality summary.
If nobody uploads the document, the platform does not leave a blank. It logs an issue and a linked risk, so the gap is tracked.
VectraIQ recommended questions
They come from a curated bank, not from a model writing questions on the fly. A question appears when your company profile matches, such as your risk tolerance or maturity level. You keep or remove each one before launch.
Penetration test report
ExampleWhat the upload is checked for
- Scope is defined: systems, applications and networks
- Methodology is stated
- The test is recent
- Findings are rated by severity
- Remediation status is given for every finding
Scoring
How the score is built.
Every answer rolls up the same way, so two assessments are comparable and you can see which control moved a number.
Show the scoring levels
Level 1
Question
Each answer is scored, and questions that matter more to your business count for more.
Level 2
Control
Answers roll up into a score for each control, so you can see which control moved the number.
Level 3
Assessment
Controls roll up into an overall score, alongside inherent risk, residual risk and a risk label.
One control, two answers
Example- MFA on admin accountsIn place
- Quarterly access reviewsPartly in place
Control result: mostly effective, with the access reviews flagged as an issue.
A plain risk label
A completed assessment carries a label from Very Low to Critical, such as Moderate Risk, based on the risk that remains after your controls. How risk is rated is on risk management.
What you get
A report built from the assessment itself.
Every section of the report is filled from the assessment record, so nobody retypes findings into a document.
Show the report sections
Executive summary
Overall risk rating, inherent and residual risk, and the overall score, with a summary drafted by VectraIQ and reviewed by your cyber expert.
Identified issues
Each issue with its description, remediation plan and severity.
Identified risks
Each risk with its risk statement, recommended controls, and inherent and residual rating.
Scope and method
The frameworks used, the approach, and the documents reviewed.
Issues and risks are also real records in your registers, ready for owners and dates. See risk management.
Who does what
Your team answers. VectraIQ drafts. Your expert team decides.
Your team
- Answer the questions in the platform, with no spreadsheet round trips
- Upload the documents each question asks for
- Keep the company profile current if you use the VectraIQ method
VectraIQ
- Recommends questions from your company profile
- Scores the answers
- Checks each uploaded document against its requirements
- Drafts the executive summary and company overview
- Maps answers to issues and risks
Your expert team
- Sets the assessment up with you and joins it as an advisor
- Reviews the issues and risks that were drafted
- Decides what goes into the register, and in what order to work it
The assessment is one part of a managed program. The same engine runs vendor reviews, covered under third-party risk, and controls carry across frameworks as described in frameworks and controls.
Questions, answered.
Can I see the questions before I commit to a framework?
Yes. You can preview every question for a framework before anyone starts answering, and see roughly how long it will take.
Are the VectraIQ questions written by AI as I go?
No. They come from a curated question bank and are selected when your company profile matches, such as your risk tolerance or maturity level. They are scored like every other question.
What happens if a required document is not uploaded?
The platform logs the gap as an issue and a linked risk, so it is tracked like any other finding.
Who can see our assessment data?
The people assigned to the assessment, your admins and your expert team. How the platform protects that data is on the security page.
More in the platform
Where the results go next.
- Third-party riskAssess vendors, tier them by criticality and keep watching them between reviews.
- Risk managementA risk register with owners, treatment and progress, rolled up into dashboards.
- Audit and compliancePolicies, controls and evidence kept current, so audit prep is a review.
- Frameworks and controlsOne control library mapped across the frameworks you report against.
- Reporting and dashboardsExecutive dashboards and board reports drafted for your cyber expert to finalize.
- VectraIQThe AI inside the platform: ask where you stand, get insights, draft reports.
Run your first assessment with an expert beside you.
Tell us which framework you answer to and we will walk through the questions and the report.