{"text_format":"1","workbook":"xlsx","n_sheets":9,"sheets":["references","MMAT ref","Introduction","Guidelines","Profile and Scope","Configuration","Text clean","Assessment","Results"],"not_rendered":{"charts":1,"images":5,"macros":1,"external_links":0,"defined_names":50,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"references","index":0,"n_rows":49,"n_cols":21,"rows_kept":49,"cut":false,"hidden":true,"merged":[]}
["Not yet answered",null,1,2,3,4,5,6,7,8,9,null,"Not yet answered",null,null,22,null,null,"x 1",1,{"$f":"S1","v":"x 1"}]
["Level 1 - Initial",null,"Not Yet answered","Level 1 - Initial","Level 2 - Established","Level 3 - Business Enabling","Level 4 - Quantitatively Managed","Level 5 - Optimised","Don't know","Not applicable","Question not selected",null,"Level 1 - Initial",null,null,null,null,null,"x 2",2,{"$f":"S2","v":"x 2"}]
["Level 2 - Established",null,{"$f":"\"\"","v":""},1,2,3,4,5,1,{"$f":"\"\"","v":""},{"$f":"\"\"","v":""},null,"Level 2 - Established",null,null,null,null,null,"x 3",3,{"$f":"S3","v":"x 3"}]
["Level 3 - Business Enabling",null,null,null,null,null,null,null,null,null,null,null,"Level 3 - Business Enabling"]
["Level 4 - Quantitatively Managed",null,null,null,null,null,null,null,null,null,null,null,"Level 4 - Quantitatively Managed",null,null,null,null,"Level 1",1]
["Level 5 - Optimised",null,null,null,null,null,null,null,null,null,null,null,"Level 5 - Optimised",null,null,null,null,"Level 2",1]
["Don't know",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Level 3",2]
["Not applicable",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Level 4",3]
["Question not selected",null,null,null,null,null,null,null,null,null,null,null,"No",null,null,null,null,"Level 5",3]
[null,null,null,null,null,null,null,null,null,null,null,null,"Yes"]
["Level 1 - Initial",null,null,null,null,"Level 1 -\nInitial"]
["Level 2 - Established",null,null,null,null,"Level 2 -\nEstablished",null,null,null,null,null,1,"Not yet answered",{"$f":"\"\"","v":""}]
["Level 3 - Business Enabling",null,null,null,null,"Level 3 -\nBusiness Enabling",null,null,null,null,null,2,"No",0]
["Level 4 - Quantitatively Managed",null,null,null,null,"Level 4 -\nQuantitatively Managed",null,null,null,null,null,3,"Partly",1]
["Level 5 - Optimised",null,null,null,null,"Level 5 -\nOptimised",null,null,null,null,null,4,"Mostly",2]
[null,null,null,null,null,null,null,null,null,null,null,5,"Fully",3]
["x 1",null,1,2,3,null,null,null,null,null,null,6,"Don't know",0]
["x 2",null,"x 1","x 2","x 3",null,null,null,null,null,null,7,"Not selected",{"$f":"\"\"","v":""}]
["x 3",null,1,2,3]
[]
[]
[]
["Systems"]
["Web presence",null,null,null,null,"Merchant banking",null,null,null,null,"Whole organisation"]
["Mobile devices",null,null,null,null,"Retail banking",null,null,null,null,"Region"]
["Third-party applications",null,null,null,null,"Investment banking",null,null,null,null,"Business unit"]
["Outsourced systems",null,null,null,null,"Card services",null,null,null,null,"Web application"]
["Other",null,null,null,null,"Other banking services",null,null,null,null,"Infrastructure"]
[null,null,null,null,null,"Other financial services"]
[null,null,null,null,null,"Agriculture, Forestry, Fishing and Hunting"]
[null,null,null,null,null,"Mining, Quarrying, and Oil and Gas Extraction"]
[null,null,null,null,null,"Utilities"]
[null,null,null,null,null,"Construction"]
[null,null,null,null,null,"Manufacturing"]
[null,null,null,null,null,"Wholesale Trade"]
[null,null,null,null,null,"Retail Trade"]
[null,null,null,null,null,"Transportation and Warehousing"]
[null,null,null,null,null,"Information"]
[null,null,null,null,null,"Insurance"]
[null,null,null,null,null,"Real Estate and Rental and Leasing"]
[null,null,null,null,null,"Professional, Scientific, and Technical Services"]
[null,null,null,null,null,"Management of Companies and Enterprises"]
[null,null,null,null,null,"Administrative and Support and Waste Management and Remediation Services"]
[null,null,null,null,null,"Educational Services"]
[null,null,null,null,null,"Health Care and Social Assistance"]
[null,null,null,null,null,"Arts, Entertainment, and Recreation"]
[null,null,null,null,null,"Accommodation and Food Services"]
[null,null,null,null,null,"Other Services (except Public Administration)"]
[null,null,null,null,null,"Public Administration"]

{"sheet":"MMAT ref","index":1,"n_rows":18,"n_cols":36,"rows_kept":18,"cut":false,"hidden":true,"merged":[]}
["CSIR","Overall",{"$f":"AVERAGE(K:K)","v":{"$error":"#DIV/0!"}},{"$f":"IF(ISERROR(C1),\"\",C1)","v":""},{"$f":"AVERAGE(M:M)","v":{"$error":"#DIV/0!"}},{"$f":"IF(ISERROR(E1),\"\",E1)","v":""},null,1,"MMAT1",{"$f":"IF(SUMIF(N:N,H1,U:U)=0,\"\",SUMIF(N:N,H1,U:U)/(MAX(T:T)*COUNTIF(V:V,H1)))","v":""},{"$f":"IF(ISERROR(J1),\"\",J1)","v":""},{"$f":"IF(SUMIF(N:N,H1,Y:Y)=0,\"\",SUMIF(N:N,H1,Y:Y)/(MAX(T:T)*COUNTIF(Z:Z,H1)))","v":""},{"$f":"IF(ISERROR(L1),\"\",L1)","v":""},1,1,1,{"$f":"N1&\".\"&O1","v":"1.1"},{"$f":"VLOOKUP(Q1,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q1,Assessment!N:T,7,FALSE)","v":1},{"$f":"IF(LEN(R1)>0,S1,\"\")","v":""},{"$f":"IF(ISERROR(T1*R1),\"\",T1*R1)","v":""},{"$f":"IF(LEN(U1)>0,N1,\"\")","v":""},{"$f":"VLOOKUP(Q1,Configuration!M:S,7,FALSE)","v":""},{"$f":"IF(LEN(W1)>0,S1,\"\")","v":""},{"$f":"IF(ISERROR(X1*W1),\"\",X1*W1)","v":""},{"$f":"IF(LEN(Y1)>0,N1,\"\")","v":""},null,1,1,1,null,null,{"$f":"IF(AC1=1,AD1,AD1&\".\"&AE1)","v":1},{"$f":"IF(AC1=1,\"Phase \"&AD1,\"Step \"&AE1)","v":"Phase 1"},"Prepare","Prepare"]
[null,null,null,null,null,null,null,2,"MMAT2",{"$f":"IF(SUMIF(N:N,H2,U:U)=0,\"\",SUMIF(N:N,H2,U:U)/(MAX(T:T)*COUNTIF(V:V,H2)))","v":""},{"$f":"IF(ISERROR(J2),\"\",J2)","v":""},{"$f":"IF(SUMIF(N:N,H2,Y:Y)=0,\"\",SUMIF(N:N,H2,Y:Y)/(MAX(T:T)*COUNTIF(Z:Z,H2)))","v":""},{"$f":"IF(ISERROR(L2),\"\",L2)","v":""},1,2,2,{"$f":"N2&\".\"&O2","v":"1.2"},{"$f":"VLOOKUP(Q2,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q2,Assessment!N:T,7,FALSE)","v":1},{"$f":"IF(LEN(R2)>0,S2,\"\")","v":""},{"$f":"IF(ISERROR(T2*R2),\"\",T2*R2)","v":""},{"$f":"IF(LEN(U2)>0,N2,\"\")","v":""},{"$f":"VLOOKUP(Q2,Configuration!M:S,7,FALSE)","v":""},{"$f":"IF(LEN(W2)>0,S2,\"\")","v":""},{"$f":"IF(ISERROR(X2*W2),\"\",X2*W2)","v":""},{"$f":"IF(LEN(Y2)>0,N2,\"\")","v":""},null,2,2,1,1,1,{"$f":"IF(AC2=1,AD2,AD2&\".\"&AE2)","v":"1.1"},{"$f":"IF(AC2=1,\"Phase \"&AD2,\"Step \"&AE2)","v":"Step 1"},"Conduct a criticality assessment for your organisation","Criticality assessment"]
[null,null,null,null,null,null,null,3,"MMAT3",{"$f":"IF(SUMIF(N:N,H3,U:U)=0,\"\",SUMIF(N:N,H3,U:U)/(MAX(T:T)*COUNTIF(V:V,H3)))","v":""},{"$f":"IF(ISERROR(J3),\"\",J3)","v":""},{"$f":"IF(SUMIF(N:N,H3,Y:Y)=0,\"\",SUMIF(N:N,H3,Y:Y)/(MAX(T:T)*COUNTIF(Z:Z,H3)))","v":""},{"$f":"IF(ISERROR(L3),\"\",L3)","v":""},1,3,3,"1.3",{"$f":"VLOOKUP(Q3,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q3,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q3,Configuration!M:S,7,FALSE)","v":""},"","","",null,3,2,1,2,2,"1.2","Step 2","Carry out a cyber security threat analysis, supported by realistic scenarios and rehearsals","Threat analysis"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,1,4,4,"1.4",{"$f":"VLOOKUP(Q4,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q4,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q4,Configuration!M:S,7,FALSE)","v":""},"","","",null,4,2,1,3,3,"1.3","Step 3","Consider the implications of people, process and technology","People, Process, Technology and Information"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,1,5,5,"1.5",{"$f":"VLOOKUP(Q5,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q5,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q5,Configuration!M:S,7,FALSE)","v":""},"","","",null,5,2,1,4,4,"1.4","Step 4","Create an appropriate control environment","Control environment"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,1,6,"2.1",{"$f":"VLOOKUP(Q6,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q6,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q6,Configuration!M:S,7,FALSE)","v":""},"","","",null,6,2,1,5,5,"1.5","Step 5","Review your state of readiness in cyber security response","Maturity assessment"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,2,7,"2.2",{"$f":"VLOOKUP(Q7,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q7,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q7,Configuration!M:S,7,FALSE)","v":""},"","","",null,7,1,2,null,null,2,"Phase 2","Respond","Respond"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,3,8,"2.3",{"$f":"VLOOKUP(Q8,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q8,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q8,Configuration!M:S,7,FALSE)","v":""},"","","",null,8,2,2,1,6,"2.1","Step 1","Identify cyber security incident","Identification"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,2,4,9,"2.4",{"$f":"VLOOKUP(Q9,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q9,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q9,Configuration!M:S,7,FALSE)","v":""},"","","",null,9,2,2,2,7,"2.2","Step 2","Define objectives and investigate situation","Investigation"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,1,10,"3.1",{"$f":"VLOOKUP(Q10,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q10,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q10,Configuration!M:S,7,FALSE)","v":""},"","","",null,10,2,2,3,8,"2.3","Step 3","Take appropriate action","Action"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,2,11,"3.2",{"$f":"VLOOKUP(Q11,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q11,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q11,Configuration!M:S,7,FALSE)","v":""},"","","",null,11,2,2,4,9,"2.4","Step 4","Recover systems, data and connectivity","Recovery"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,3,12,"3.3",{"$f":"VLOOKUP(Q12,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q12,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q12,Configuration!M:S,7,FALSE)","v":""},"","","",null,12,1,3,null,null,3,"Phase 3","Follow Up","Follow up"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,4,13,"3.4",{"$f":"VLOOKUP(Q13,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q13,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q13,Configuration!M:S,7,FALSE)","v":""},"","","",null,13,2,3,1,10,"3.1","Step 1","Investigate incident more thoroughly","Incident investigation"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,5,14,"3.5",{"$f":"VLOOKUP(Q14,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q14,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q14,Configuration!M:S,7,FALSE)","v":""},"","","",null,14,2,3,2,11,"3.2","Step 2","Report incident to relevant stakeholders","Reporting"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,3,6,15,"3.6",{"$f":"VLOOKUP(Q15,Assessment!N:Q,4,FALSE)","v":""},{"$f":"VLOOKUP(Q15,Assessment!N:T,7,FALSE)","v":1},"","","",{"$f":"VLOOKUP(Q15,Configuration!M:S,7,FALSE)","v":""},"","","",null,15,2,3,3,12,"3.3","Step 3","Carry out a post incident investigation review","Post incident review"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,16,2,3,4,13,"3.4","Step 4","Communicate and build on lessons learned","Lessons learned"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,17,2,3,5,14,"3.5","Step 5","Update key information, controls and processes","Updating"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,18,2,3,6,15,"3.6","Step 6","Perform trend analysis","Trend analysis"]

{"sheet":"Introduction","index":2,"n_rows":85,"n_cols":4,"rows_kept":85,"cut":false,"hidden":false,"merged":[[71,1,72,11],[76,1,77,11],[86,1,86,11],[1,3,4,15],[11,1,15,11],[17,1,20,11],[21,1,23,11],[28,1,31,11],[37,1,39,11],[32,1,34,11],[80,1,80,11]]}
[]
[null,null,null,"Cyber Security Incident Response \nHigh-level Maturity Assessment Tool"]
[]
[]
[]
[]
[]
[null,"Introduction"]
[]
[null,"Overview"]
[]
[null,"Many organisations are extremely concerned about potential and actual cyber security attacks, both on their own organisations and in ones similar to them. Dealing with cyber security incidents – particularly sophisticated cyber security attacks – can be a very difficult task, even for the most advanced organisations. Each organisation should therefore develop an appropriate cyber security incident response capability, which will enable them to adopt a systematic, structured approach to cyber security incident response."]
[]
[]
[]
[]
[]
[null,"Your cyber security incident response capability should consist of appropriately skilled people guided by well-designed, repeatable processes and effective use of relevant technologies that will enable you to conduct a thorough investigation and successfully eradicate adversaries who are deeply embedded in your environment."]
[]
[]
[]
[null,"However, many organisations do not know their state of readiness to be able to respond to a cyber security incident in a fast, effective manner. One of the best ways to help determine this is to measure the level of maturity of your cyber security incident response capability in terms of:"]
[]
[]
[]
[null,null,"• People, process, technology and information"]
[null,null,"• Preparedness, response and follow up activities"]
[]
[null,"This assessment tool provides a mechanism for carrying out an assessment of the level of maturity an organisation has for their cyber security incident response capability at a high level. It can be used to assess your state of readiness in being able to respond to a cyber security incident in a fast, effective and secure manner."]
[]
[]
[]
[null,"Note: There is also a Detailed Maturity Assessment Tool available, which allows an assessment to be made to determine the level of maturity of your cyber security incident response capability in depth."]
[]
[]
[null,"Cyber Security Incident response process"]
[]
[null,"This tool provides a high-level assessment against a maturity model that is based on the 15 steps within the 3 phase Cyber Security Incident response process presented in the CREST Cyber Security Incident Response Guide, as shown in the diagram below."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Instructions on how the tool works and how it can be used can be found on the Guidelines worksheet."]
[]
[null,"Acknowledgements"]
[]
[null,"CREST would like to extend its special thanks to those CREST member organisations and third parties who took part in interviews, participated in the workshop and completed questionnaires."]
[]
[]
[null,"Warning"]
[]
[null,"This Guide has been produced with care and to the best of our ability. However, CREST accepts no responsibility for any problems or incidents arising from its use."]
[]
[]
[null,"Credits"]
[]
[null,"This tool has been developed for CREST by "]
[]
[]
[null,"© CREST 2014"]

{"sheet":"Guidelines","index":3,"n_rows":82,"n_cols":4,"rows_kept":82,"cut":false,"hidden":false,"merged":[[81,1,85,11],[43,1,46,11],[1,3,4,15],[11,1,13,11],[15,1,17,11],[34,1,37,11],[39,1,42,11],[74,1,76,11],[78,1,79,11],[69,1,72,11],[50,1,52,11],[54,1,57,11],[59,1,61,11],[63,1,67,11]]}
[]
[null,null,null,"Cyber Security Incident Response \nHigh-level Maturity Assessment Tool"]
[]
[]
[]
[]
[]
[null,"Guidelines"]
[]
[null,"Maturity model"]
[]
[null,"To deal with a cyber security incident quickly and effectively you will need to build an appropriate cyber security incident response capability, the maturity of which can be assessed against an appropriate maturity model by using this assessment tool."]
[]
[]
[]
[null,"The maturity model used in this tool is based on a traditional, proven model shown below. This model can be used to determine the level of maturity of an organisation cyber security incident response capability, ranging from 1 (least effective) to 5 (most effective)."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Different types of organisation will require different levels of maturity in cyber security incident response. For example, a small company operating in the retail business will not have the same requirement – or ability – to respond to cyber security incidents in the same way as a major corporate organisation in the finance sector – or a government department. "]
[]
[]
[]
[]
[null,"Consequently, the level of maturity your organisation has in cyber security incident response should be reviewed in context and compared to your actual requirements for such a capability. The maturity of your organisation can then be compared with other similar organisation to help determine if the level of maturity is appropriate. "]
[]
[]
[]
[null,"Note: The maturity of the cyber security incident response capability can play a significant role in determining the level of third-party involvement required during a breach investigation and eradication event. Organisations with mature cyber security incident response capabilities may conduct most of their operations in-house, while those who are less mature may depend entirely on third parties."]
[]
[]
[]
[]
[null,"How to use the tool"]
[]
[null,"This tool allows an assessment to be made to determine the level of maturity of an organisations’ cyber security incident response capability at a high level. It is based on a simple selection of the level of maturity for each of the 15 steps."]
[]
[]
[]
[null,"A weighting factor can be set to give the results for particular steps more importance than others. The selected levels of maturity are then displayed graphically for each of the three phases and overall. Calculations are based on a carefully designed algorithm that takes account of both the level of maturity selected for each step and the step's given weighting."]
[]
[]
[]
[]
[null,"Step 1 - Complete the details for the environment being assessed in the Profile and Scope worksheet using the text boxes and drop-down lists provided. The name entered for Name of Area of Assessment will automatically appear on the Results worksheet."]
[]
[]
[]
[null,"Step 2 - On the Configuration worksheet use the checkboxes next to each step to deselect any steps not appropriate to the assessment. Then use the first column of drop-down lists to select  the target level of maturity required for each step. Any steps you feel warrant greater importance can be given a higher weighting using the second column of drop-down lists. Evidence required to support responses can be entered in the Evidence column."]
[]
[]
[]
[]
[]
[null,"Note: The weighting values set on the Configuration worksheet can be overriden on the Assessment worksheet. If you are configuring the tool for a respondent and do not want these weightings to be changed, use the Lock weighting and/or Hide weighting buttons as appropriate, and then hide the Configuration worksheet by right-clicking on the relevant tab at the bottom of this spreadsheet and choosing Hide.  "]
[]
[]
[]
[]
[null,"Step 3 - Carry out the assessment by selecting the appropriate level of maturity within the assessed environment for each step using the drop-down lists on the Assessment worksheet. Any additional comments can be entered in the Comments column."]
[]
[]
[]
[null,"Step 4 - Review a summary of the results using the Results worksheet to gain a high level picture of the overall level of maturity for the environment assessed."]
[]
[]
[null,"Note: You may wish to consider conducting a more in-depth assessment of one or more elements of your cyber security incident response capability by using the Detailed Maturity Assessment Tool."]

{"sheet":"Profile and Scope","index":4,"n_rows":45,"n_cols":5,"rows_kept":45,"cut":false,"hidden":false,"merged":[[0,4,0,6],[41,5,41,6],[44,5,44,6],[35,5,35,6],[4,5,4,6],[7,5,7,6],[10,5,10,6],[26,5,26,6],[29,5,29,6],[32,5,32,6],[19,5,19,6]]}
[null,null,null,null,"Cyber Security Incident Response \nHigh-level Maturity Assessment Tool"]
[]
[null,null,null,null,"Scope of assessment     All fields marked * MUST be completed"]
[]
[null,null,null,null,"Name of area of assessment *"]
[]
[]
[null,null,null,null,"Business unit (or equivalent) *"]
[]
[]
[null,null,null,null,"Organisation *"]
[]
[]
[null,null,null,null,"Sector *"]
[]
[]
[null,null,null,null,"Scope of assessment *"]
[]
[]
[null,null,null,null,"Key components"]
[]
[null,null,null,null,"Respondent details     All fields marked * MUST be completed"]
[]
[null,null,null,null,"Date of assessment *"]
[]
[]
[null,null,null,null,"Name of respondent *"]
[]
[]
[null,null,null,null,"Role or position *"]
[]
[]
[null,null,null,null,"Department *"]
[]
[]
[null,null,null,null,"Organisation *"]
[]
[]
[null,null,null,null,"Type of assessment *"]
[]
[]
[null,null,null,null,"Qualifications of assessor - CREST *"]
[]
[]
[null,null,null,null,"Qualifications of assessor - other *"]

{"sheet":"Configuration","index":5,"n_rows":21,"n_cols":33,"rows_kept":21,"cut":false,"hidden":false,"merged":[]}
[null,null,null,null,"Configuration"]
[null,null,null,"Cyber Security Incident Response Maturity Model Assessment Tool"]
[null,null,null,null,null,"Not selected","Target maturity level","Weighting","Evidence required"]
[1,{"$f":"IF(ISBLANK(C4),\"\",A4)","v":""},null,null,{"$f":"AF4&\" - \"&AG4","v":"Phase 1 - Prepare"},null,null,null,null,null,null,null,null,1,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"VLOOKUP($N4,MMATref,7,FALSE)","v":"Phase 1"},{"$f":"VLOOKUP($N4,MMATref,8,FALSE)","v":"Prepare"}]
[{"$f":"IF(ISBLANK(C5),A4+1,A4)","v":1},1,{"$f":"VLOOKUP(N5,MMATref,5,FALSE)","v":1},null,"Step 1 - Conduct a criticality assessment for your organisation",null,null,null,null,null,null,null,{"$f":"B5&\".\"&VLOOKUP(N5,MMATref,4,FALSE)","v":"1.1"},2,null,1,false,{"$f":"HLOOKUP(P5,target_scores,3,FALSE)","v":""},{"$f":"IF(R5=\"Null\",\"\",R5)","v":""},null,null,null,null,null,null,null,{"$f":"IF(LEN(I5)=0,\"\",I5)","v":""},null,null,null,null,"Step 1","Conduct a criticality assessment for your organisation"]
[1,1,{"$f":"VLOOKUP(N6,MMATref,5,FALSE)","v":2},null,"Step 2 - Carry out a cyber security threat analysis, supported by realistic scenarios and rehearsals",null,null,null,null,null,null,null,{"$f":"B6&\".\"&VLOOKUP(N6,MMATref,4,FALSE)","v":"1.2"},3,null,1,false,{"$f":"HLOOKUP(P6,target_scores,3,FALSE)","v":""},{"$f":"IF(R6=\"Null\",\"\",R6)","v":""},null,null,null,null,null,null,null,{"$f":"IF(LEN(I6)=0,\"\",I6)","v":""},null,null,null,null,"Step 2","Carry out a cyber security threat analysis, supported by realistic scenarios and rehearsals"]
[1,1,{"$f":"VLOOKUP(N7,MMATref,5,FALSE)","v":3},null,"Step 3 - Consider the implications of people, process and technology",null,null,null,null,null,null,null,{"$f":"B7&\".\"&VLOOKUP(N7,MMATref,4,FALSE)","v":"1.3"},4,null,1,false,{"$f":"HLOOKUP(P7,target_scores,3,FALSE)","v":""},"",null,null,null,null,null,null,null,"",null,null,null,null,"Step 3","Consider the implications of people, process and technology"]
[1,1,{"$f":"VLOOKUP(N8,MMATref,5,FALSE)","v":4},null,"Step 4 - Create an appropriate control environment",null,null,null,null,null,null,null,{"$f":"B8&\".\"&VLOOKUP(N8,MMATref,4,FALSE)","v":"1.4"},5,null,1,false,{"$f":"HLOOKUP(P8,target_scores,3,FALSE)","v":""},"",null,null,null,null,null,null,null,"",null,null,null,null,"Step 4","Create an appropriate control environment"]
[1,1,{"$f":"VLOOKUP(N9,MMATref,5,FALSE)","v":5},null,"Step 5 - Review your state of readiness in cyber security response",null,null,null,null,null,null,null,{"$f":"B9&\".\"&VLOOKUP(N9,MMATref,4,FALSE)","v":"1.5"},6,null,1,false,{"$f":"HLOOKUP(P9,target_scores,3,FALSE)","v":""},"",null,null,null,null,null,null,null,"",null,null,null,null,"Step 5","Review your state of readiness in cyber security response"]
[2,"",null,null,"Phase 2 - Respond",null,null,null,null,null,null,null,null,7,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Phase 2","Respond"]
[2,2,{"$f":"VLOOKUP(N11,MMATref,5,FALSE)","v":6},null,"Step 1 - Identify cyber security incident",null,null,null,null,null,null,null,{"$f":"B11&\".\"&VLOOKUP(N11,MMATref,4,FALSE)","v":"2.1"},8,null,1,false,{"$f":"HLOOKUP(P11,target_scores,3,FALSE)","v":""},{"$f":"IF(R11=\"Null\",\"\",R11)","v":""},null,null,null,null,null,null,null,{"$f":"IF(LEN(I11)=0,\"\",I11)","v":""},null,null,null,null,"Step 1","Identify cyber security incident"]
[2,2,{"$f":"VLOOKUP(N12,MMATref,5,FALSE)","v":7},null,"Step 2 - Define objectives and investigate situation",null,null,null,null,null,null,null,{"$f":"B12&\".\"&VLOOKUP(N12,MMATref,4,FALSE)","v":"2.2"},9,null,1,false,{"$f":"HLOOKUP(P12,target_scores,3,FALSE)","v":""},"",null,null,null,null,null,null,null,"",null,null,null,null,"Step 2","Define objectives and investigate situation"]
[2,2,{"$f":"VLOOKUP(N13,MMATref,5,FALSE)","v":8},null,"Step 3 - Take appropriate action",null,null,null,null,null,null,null,{"$f":"B13&\".\"&VLOOKUP(N13,MMATref,4,FALSE)","v":"2.3"},10,null,1,false,{"$f":"HLOOKUP(P13,target_scores,3,FALSE)","v":""},"",null,null,null,null,null,null,null,"",null,null,null,null,"Step 3","Take appropriate action"]
[2,2,{"$f":"VLOOKUP(N14,MMATref,5,FALSE)","v":9},null,"Step 4 - Recover systems, data and connectivity",null,null,null,null,null,null,null,{"$f":"B14&\".\"&VLOOKUP(N14,MMATref,4,FALSE)","v":"2.4"},11,null,1,false,{"$f":"HLOOKUP(P14,target_scores,3,FALSE)","v":""},"",null,null,null,null,null,null,null,"",null,null,null,null,"Step 4","Recover systems, data and connectivity"]
[3,"",null,null,"Phase 3 - Follow Up",null,null,null,null,null,null,null,null,12,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Phase 3","Follow Up"]
[3,3,{"$f":"VLOOKUP(N16,MMATref,5,FALSE)","v":10},null,"Step 1 - Investigate incident more thoroughly",null,null,null,null,null,null,null,{"$f":"B16&\".\"&VLOOKUP(N16,MMATref,4,FALSE)","v":"3.1"},13,null,1,false,{"$f":"HLOOKUP(P16,target_scores,3,FALSE)","v":""},{"$f":"IF(R16=\"Null\",\"\",R16)","v":""},null,null,null,null,null,null,null,{"$f":"IF(LEN(I16)=0,\"\",I16)","v":""},null,null,null,null,"Step 1","Investigate incident more thoroughly"]
[3,3,11,null,"Step 2 - Report incident to relevant stakeholders",null,null,null,null,null,null,null,"3.2",14,null,1,false,"","",null,null,null,null,null,null,null,"",null,null,null,null,"Step 2","Report incident to relevant stakeholders"]
[3,3,12,null,"Step 3 - Carry out a post incident investigation review",null,null,null,null,null,null,null,"3.3",15,null,1,false,"","",null,null,null,null,null,null,null,"",null,null,null,null,"Step 3","Carry out a post incident investigation review"]
[3,3,13,null,"Step 4 - Communicate and build on lessons learned",null,null,null,null,null,null,null,"3.4",16,null,1,false,"","",null,null,null,null,null,null,null,"",null,null,null,null,"Step 4","Communicate and build on lessons learned"]
[3,3,14,null,"Step 5 - Update key information, controls and processes",null,null,null,null,null,null,null,"3.5",17,null,1,false,"","",null,null,null,null,null,null,null,"",null,null,null,null,"Step 5","Update key information, controls and processes"]
[3,3,15,null,"Step 6 - Perform trend analysis",null,null,null,null,null,null,null,"3.6",18,null,1,false,"","",null,null,null,null,null,null,null,"",null,null,null,null,"Step 6","Perform trend analysis"]

{"sheet":"Text clean","index":6,"n_rows":61,"n_cols":30,"rows_kept":61,"cut":false,"hidden":true,"merged":[]}
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.1","Level 1","Have you defined your critical information assets (eg important business applications, key systems and confidential data)?",null,null,null,{"$f":"FIND(\".\",M1)","v":2},{"$f":"FIND(\".\",M1,S1+1)","v":4},{"$f":"LEFT(M1,S1-1)","v":"1"},{"$f":"MID(M1,S1+1,T1-S1-1)","v":"1"},{"$f":"RIGHT(M1,LEN(M1)-T1)","v":"1"},{"$f":"VALUE(W1)","v":1},{"$f":"IF(ISERROR(X1),LEFT(W1,LEN(W1)-1),W1)","v":"1"},{"$f":"IF(ISERROR(X1),RIGHT(W1,1),\"\")","v":""},{"$f":"TEXT(Y1,\"00\")","v":"01"},{"$f":"U1&\".\"&V1&\".\"&AA1&IF(LEN(Z1)=0,\"\",\".\"&Z1)","v":"1.1.01"},{"$f":"N1","v":"Level 1"},{"$f":"O1","v":"Have you defined your critical information assets (eg important business applications, key systems and confidential data)?"}]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.2","Level 2","Do you carry out criticality assessments?",null,null,null,{"$f":"FIND(\".\",M2)","v":2},{"$f":"FIND(\".\",M2,S2+1)","v":4},{"$f":"LEFT(M2,S2-1)","v":"1"},{"$f":"MID(M2,S2+1,T2-S2-1)","v":"1"},{"$f":"RIGHT(M2,LEN(M2)-T2)","v":"2"},{"$f":"VALUE(W2)","v":2},{"$f":"IF(ISERROR(X2),LEFT(W2,LEN(W2)-1),W2)","v":"2"},{"$f":"IF(ISERROR(X2),RIGHT(W2,1),\"\")","v":""},{"$f":"TEXT(Y2,\"00\")","v":"02"},{"$f":"U2&\".\"&V2&\".\"&AA2&IF(LEN(Z2)=0,\"\",\".\"&Z2)","v":"1.1.02"},{"$f":"N2","v":"Level 2"},{"$f":"O2","v":"Do you carry out criticality assessments?"}]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.3","","Are critical information assets defined in a:",null,null,null,2,4,"1","1","3",3,"3","","03","1.1.03","","Are critical information assets defined in a:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.3a","Level 2","Structured, systematic manner?",null,null,null,2,4,"1","1","3a",{"$error":"#VALUE!"},"3","a","03","1.1.03.a","Level 2","Structured, systematic manner?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.3b","Level 3","Quantitative manner, (eg in terms of their strategic or monetary value)?",null,null,null,2,4,"1","1","3b",{"$error":"#VALUE!"},"3","b","03","1.1.03.b","Level 3","Quantitative manner, (eg in terms of their strategic or monetary value)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.4","","Do your criticality assessments include:",null,null,null,2,4,"1","1","4",4,"4","","04","1.1.04","","Do your criticality assessments include:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.4a","Level 3","Determining which cyber security threats are most likely to affect these critical information assets?",null,null,null,2,4,"1","1","4a",{"$error":"#VALUE!"},"4","a","04","1.1.04.a","Level 3","Determining which cyber security threats are most likely to affect these critical information assets?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.4b","Level 3","Applying the relevant management or technical controls to reduce the likelihood and impact of cyber security incidents affecting their critical information assets?",null,null,null,2,4,"1","1","4b",{"$error":"#VALUE!"},"4","b","04","1.1.04.b","Level 3","Applying the relevant management or technical controls to reduce the likelihood and impact of cyber security incidents affecting their critical information assets?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.4c","Level 3","Raising awareness about the need for an effective cyber security response capability?",null,null,null,2,4,"1","1","4c",{"$error":"#VALUE!"},"4","c","04","1.1.04.c","Level 3","Raising awareness about the need for an effective cyber security response capability?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.4d","Level 3","Determining the likely (or actual) level of business impact caused if your organisation was hit by a cyber security incident?",null,null,null,2,4,"1","1","4d",{"$error":"#VALUE!"},"4","d","04","1.1.04.d","Level 3","Determining the likely (or actual) level of business impact caused if your organisation was hit by a cyber security incident?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.5","Level 3","Do you conduct formal business impact assessments?",null,null,null,2,4,"1","1","5",5,"5","","05","1.1.05","Level 3","Do you conduct formal business impact assessments?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.6","","Do your business impact assessments determine the level of business impact if:",null,null,null,2,4,"1","1","6",6,"6","","06","1.1.06","","Do your business impact assessments determine the level of business impact if:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.6a","Level 3","Sensitive information was disclosed to unauthorised parties (confidentiality)?",null,null,null,2,4,"1","1","6a",{"$error":"#VALUE!"},"6","a","06","1.1.06.a","Level 3","Sensitive information was disclosed to unauthorised parties (confidentiality)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.6b","Level 3","Important information was compromised (eg key data is inaccurate or wrongly processed)?",null,null,null,2,4,"1","1","6b",{"$error":"#VALUE!"},"6","b","06","1.1.06.b","Level 3","Important information was compromised (eg key data is inaccurate or wrongly processed)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.6c","Level 3","Critical systems or infrastructure were no longer available?",null,null,null,2,4,"1","1","6c",{"$error":"#VALUE!"},"6","c","06","1.1.06.c","Level 3","Critical systems or infrastructure were no longer available?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.7","Level 4","Have you identified where your critical assets are located in your organisation?",null,null,null,2,4,"1","1","7",7,"7","","07","1.1.07","Level 4","Have you identified where your critical assets are located in your organisation?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.8","Level 4","Have you assigned responsibility for protecting your critical assets to capable, named individuals?",null,null,null,2,4,"1","1","8",8,"8","","08","1.1.08","Level 4","Have you assigned responsibility for protecting your critical assets to capable, named individuals?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.9","Level 5","Have you identified where critical assets are located in relevant third party organisations (eg cloud service providers)?",null,null,null,2,4,"1","1","9",9,"9","","09","1.1.09","Level 5","Have you identified where critical assets are located in relevant third party organisations (eg cloud service providers)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.1.10","Level 5","Are you able to gain fast access to critical assets that are located in relevant third party organisations?",null,null,null,2,4,"1","1","10",10,"10","","10","1.1.10","Level 5","Are you able to gain fast access to critical assets that are located in relevant third party organisations?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.1","Level 1","Do you carry out threat analysis?",null,null,null,2,4,"1","2","1",1,"1","","01","1.2.01","Level 1","Do you carry out threat analysis?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.2","Level 2","Do you review cyber security threats and associated vulnerabilities?",null,null,null,2,4,"1","2","2",2,"2","","02","1.2.02","Level 2","Do you review cyber security threats and associated vulnerabilities?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.3","Level 2","Do you review cyber security threats and associated vulnerabilities using a structured, systematic manner?",null,null,null,2,4,"1","2","3",3,"3","","03","1.2.03","Level 2","Do you review cyber security threats and associated vulnerabilities using a structured, systematic manner?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.4","","Does your cyber security threat analysis consider the:",null,null,null,2,4,"1","2","4",4,"4","","04","1.2.04","","Does your cyber security threat analysis consider the:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.4a","Level 3","Technical infrastructure that supports your critical assets?",null,null,null,2,4,"1","2","4a",{"$error":"#VALUE!"},"4","a","04","1.2.04.a","Level 3","Technical infrastructure that supports your critical assets?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.4b","Level 3","Different types of cyber security threats that you are concerned about?",null,null,null,2,4,"1","2","4b",{"$error":"#VALUE!"},"4","b","04","1.2.04.b","Level 3","Different types of cyber security threats that you are concerned about?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.4c","Level 3","Vulnerabilities to each particular threat (eg control weaknesses or special circumstances)?",null,null,null,2,4,"1","2","4c",{"$error":"#VALUE!"},"4","c","04","1.2.04.c","Level 3","Vulnerabilities to each particular threat (eg control weaknesses or special circumstances)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.5","Level 4","Do you conduct cyber security threat analysis a regular basis (because the threat landscape shifts and investigation will provide feedback)?",null,null,null,2,4,"1","2","5",5,"5","","05","1.2.05","Level 4","Do you conduct cyber security threat analysis a regular basis (because the threat landscape shifts and investigation will provide feedback)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.6","","Does your threat analysis address:",null,null,null,2,4,"1","2","6",6,"6","","06","1.2.06","","Does your threat analysis address:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.6a","Level 4","The cyber security landscape relevant to your organisation?",null,null,null,2,4,"1","2","6a",{"$error":"#VALUE!"},"6","a","06","1.2.06.a","Level 4","The cyber security landscape relevant to your organisation?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.6b","Level 4","Sources of threats (eg organised crime syndicates, state-sponsored organisations, extremist groups, hacktivists, insiders – or a combination of these)?",null,null,null,2,4,"1","2","6b",{"$error":"#VALUE!"},"6","b","06","1.2.06.b","Level 4","Sources of threats (eg organised crime syndicates, state-sponsored organisations, extremist groups, hacktivists, insiders – or a combination of these)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.6c","Level 4","Possible threat vectors for attacks to exploit (eg Internet downloads, unauthorised USB sticks, misconfigured systems, inappropriate access, or collusion)?",null,null,null,2,4,"1","2","6c",{"$error":"#VALUE!"},"6","c","06","1.2.06.c","Level 4","Possible threat vectors for attacks to exploit (eg Internet downloads, unauthorised USB sticks, misconfigured systems, inappropriate access, or collusion)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.7","","Does your threat analysis include assessing all types of vulnerabilities to particular threats, by considering the PLEST acronym, which involves considering vulnerabilities associated with the:",null,null,null,2,4,"1","2","7",7,"7","","07","1.2.07","","Does your threat analysis include assessing all types of vulnerabilities to particular threats, by considering the PLEST acronym, which involves considering vulnerabilities associated with the:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.7a","Level 4","Political environment, at both a macro and micro level",null,null,null,2,4,"1","2","7a",{"$error":"#VALUE!"},"7","a","07","1.2.07.a","Level 4","Political environment, at both a macro and micro level"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.7b","Level 5","Legal and regulatory environment, including compliance (eg reporting) requirements",null,null,null,2,4,"1","2","7b",{"$error":"#VALUE!"},"7","b","07","1.2.07.b","Level 5","Legal and regulatory environment, including compliance (eg reporting) requirements"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.7c","Level 5","Economic environment",null,null,null,2,4,"1","2","7c",{"$error":"#VALUE!"},"7","c","07","1.2.07.c","Level 5","Economic environment"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.7d","Level 5","Socio-cultural, including the important people aspect",null,null,null,2,4,"1","2","7d",{"$error":"#VALUE!"},"7","d","07","1.2.07.d","Level 5","Socio-cultural, including the important people aspect"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.7e","Level 5","Technical environment (eg logging)?",null,null,null,2,4,"1","2","7e",{"$error":"#VALUE!"},"7","e","07","1.2.07.e","Level 5","Technical environment (eg logging)?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.8","Level 5","Does your threat analysis include information obtained using cyber security threat intelligence?",null,null,null,2,4,"1","2","8",8,"8","","08","1.2.08","Level 5","Does your threat analysis include information obtained using cyber security threat intelligence?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.9","Level 5","Do you contextualise your cyber security threat analysis?",null,null,null,2,4,"1","2","9",9,"9","","09","1.2.09","Level 5","Do you contextualise your cyber security threat analysis?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.10","","Is the contextualisation of your cyber security threat analysis based on a solid understanding of:",null,null,null,2,4,"1","2","10",10,"10","","10","1.2.10","","Is the contextualisation of your cyber security threat analysis based on a solid understanding of:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.10a","Level 5","The nature of your business, business strategy, business processes and risk appetite?",null,null,null,2,4,"1","2","10a",{"$error":"#VALUE!"},"10","a","10","1.2.10.a","Level 5","The nature of your business, business strategy, business processes and risk appetite?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.10b","Level 5","Key dependencies your organisation has; for example on people, technology, suppliers, partners and the environment in which you operate?",null,null,null,2,4,"1","2","10b",{"$error":"#VALUE!"},"10","b","10","1.2.10.b","Level 5","Key dependencies your organisation has; for example on people, technology, suppliers, partners and the environment in which you operate?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.10c","Level 5","The assets which are most likely to be targeted, such as infrastructure, money, intellectual property or people – and the computer systems that support them?",null,null,null,2,4,"1","2","10c",{"$error":"#VALUE!"},"10","c","10","1.2.10.c","Level 5","The assets which are most likely to be targeted, such as infrastructure, money, intellectual property or people – and the computer systems that support them?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.10d","Level 5","The potential compromise to the confidentiality of sensitive information; the integrity of important business information and applications; or the availability of critical infrastructure?",null,null,null,2,4,"1","2","10d",{"$error":"#VALUE!"},"10","d","10","1.2.10.d","Level 5","The potential compromise to the confidentiality of sensitive information; the integrity of important business information and applications; or the availability of critical infrastructure?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.11","Level 5","Does your cyber security threat analysis give you a good understanding the level of threat to your organisation from different types of cyber security incidents?",null,null,null,2,4,"1","2","11",11,"11","","11","1.2.11","Level 5","Does your cyber security threat analysis give you a good understanding the level of threat to your organisation from different types of cyber security incidents?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12","","Performing realistic scenarios and rehearsals, for example by initiating a fictional (but realistic) attack internally and assessing how well you can respond to it. Making scenarios more effective by ensuring they include:",null,null,null,2,4,"1","2","12",12,"12","","12","1.2.12","","Performing realistic scenarios and rehearsals, for example by initiating a fictional (but realistic) attack internally and assessing how well you can respond to it. Making scenarios more effective by ensuring they include:"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12a","Level 5","Determining what the threat is to your organisation",null,null,null,2,4,"1","2","12a",{"$error":"#VALUE!"},"12","a","12","1.2.12.a","Level 5","Determining what the threat is to your organisation"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12b","Level 5","Assessing your risk profile (to key assets)",null,null,null,2,4,"1","2","12b",{"$error":"#VALUE!"},"12","b","12","1.2.12.b","Level 5","Assessing your risk profile (to key assets)"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12c","Level 5","Considering threat intelligence providers (eg the government, collaborative groups, competitors, CERTs and vendors)",null,null,null,2,4,"1","2","12c",{"$error":"#VALUE!"},"12","c","12","1.2.12.c","Level 5","Considering threat intelligence providers (eg the government, collaborative groups, competitors, CERTs and vendors)"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12d","Level 5","Evaluating situational awareness and applicability to your organisation",null,null,null,2,4,"1","2","12d",{"$error":"#VALUE!"},"12","d","12","1.2.12.d","Level 5","Evaluating situational awareness and applicability to your organisation"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12e","Level 5","Simulating a real attack as closely as possible",null,null,null,2,4,"1","2","12e",{"$error":"#VALUE!"},"12","e","12","1.2.12.e","Level 5","Simulating a real attack as closely as possible"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.12f","Level 5","Ensuring the right person is doing the right thing at the right time.",null,null,null,2,4,"1","2","12f",{"$error":"#VALUE!"},"12","f","12","1.2.12.f","Level 5","Ensuring the right person is doing the right thing at the right time."]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.13","Level 5","Does your cyber security threat analysis give you a good understanding the level of threat to your organisation from different types of cyber security incidents?",null,null,null,2,4,"1","2","13",13,"13","","13","1.2.13","Level 5","Does your cyber security threat analysis give you a good understanding the level of threat to your organisation from different types of cyber security incidents?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.14","Level 5","Do you carry out periodic scenario-based training, helping to ensure that relevant individuals understand their role and prepare them to handle cyber security incidents?",null,null,null,2,4,"1","2","14",14,"14","","14","1.2.14","Level 5","Do you carry out periodic scenario-based training, helping to ensure that relevant individuals understand their role and prepare them to handle cyber security incidents?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.15","Level 5","Does this scenario-based training work through a series of attack scenarios fine-tuned to the threats and vulnerabilities your organisation face?",null,null,null,2,4,"1","2","15",15,"15","","15","1.2.15","Level 5","Does this scenario-based training work through a series of attack scenarios fine-tuned to the threats and vulnerabilities your organisation face?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.2.16","Level 5","Do you evaluate newly emerging methods of conducting more advanced cyber security threat analysis to help improve the effectiveness of your cyber security threat analysis?",null,null,null,2,4,"1","2","16",16,"16","","16","1.2.16","Level 5","Do you evaluate newly emerging methods of conducting more advanced cyber security threat analysis to help improve the effectiveness of your cyber security threat analysis?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.3.1","Level 1","Do you carry out have a cyber security incident response policy?",null,null,null,2,4,"1","3","1",1,"1","","01","1.3.01","Level 1","Do you carry out have a cyber security incident response policy?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.3.2","Level 2","Is your cyber security incident response policy approved by senior management?",null,null,null,2,4,"1","3","2",2,"2","","02","1.3.02","Level 2","Is your cyber security incident response policy approved by senior management?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.3.3","Level 2","Does your cyber security incident response policy clearly define the responsibilities of individuals charged with managing such incidents?",null,null,null,2,4,"1","3","3",3,"3","","03","1.3.03","Level 2","Does your cyber security incident response policy clearly define the responsibilities of individuals charged with managing such incidents?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"1.3.4","Level 2","Is your cyber security incident response policy distributed to all staff?",null,null,null,2,4,"1","3","4",4,"4","","04","1.3.04","Level 2","Is your cyber security incident response policy distributed to all staff?"]
[null,null,null,null,null,null,null,null,null,null,null,null,"","",""]

{"sheet":"Assessment","index":7,"n_rows":21,"n_cols":33,"rows_kept":21,"cut":false,"hidden":false,"merged":[]}
[null,null,null,null,"High-level assessment",null,null,null,null,null,null,null,null,null,null,null,{"$f":"AVERAGE(Q4:Q21)","v":{"$error":"#DIV/0!"}}]
[null,null,null,null,{"$f":"$B3&\" questions answered out of \"&qcountselected","v":{"$error":"#NAME?"}},{"$f":"\"(\"&qcountselected&\" questions selected out of a possible \"&qcount&\")\"","v":{"$error":"#NAME?"}},null,null,null,"Sum of scores","No. of questions","No. of selected questions"]
[null,{"$f":"COUNTIF(P:P,\">1\")-COUNTIF(P:P,\">8\")","v":0},null,null,"Statement","Level of maturity","Weighting","Evidence","Comments",{"$f":"SUM($Q4:$Q1048576)","v":0},{"$f":"MAX($C4:$C199)","v":15},{"$f":"qcount-COUNTIF($P:$P,9)","v":{"$error":"#NAME?"}}]
[1,{"$f":"IF(ISBLANK(C4),\"\",A4)","v":""},null,null,{"$f":"AE4&\" - \"&AF4","v":"Phase 1 - Prepare"},null,null,null,null,null,"No. of selected questions answered",{"$f":"IF(C4=\"\",\"\",MOD(C4,2))","v":""},1,null,null,null,{"$f":"IF(P4=\"\",\"\",HLOOKUP(P4,stuff,3))","v":""},null,null,{"$f":"IF(S4=\"\",\"\",HLOOKUP(S4,weighting_stuff,3))","v":""},null,null,null,null,null,null,null,null,null,null,{"$f":"VLOOKUP($M4,MMATref,7,FALSE)","v":"Phase 1"},{"$f":"VLOOKUP($M4,MMATref,8,FALSE)","v":"Prepare"},{"$f":"IF(OR(ISBLANK(Q4),Q4=\"Null\"),\"\",Q4)","v":""}]
[{"$f":"IF(ISBLANK(C5),A4+1,A4)","v":1},1,{"$f":"VLOOKUP(M5,MMATref,5,FALSE)","v":1},null,{"$f":"AE5&\" - \"&AF5","v":"Step 1 - Conduct a criticality assessment for your organisation"},null,null,{"$f":"VLOOKUP(M5,Configuration!N:AA,14,FALSE)","v":""},null,null,{"$f":"B3","v":0},1,2,{"$f":"B5&\".\"&VLOOKUP(M5,MMATref,4,FALSE)","v":"1.1"},null,1,"",1,{"$f":"R5","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 1","Conduct a criticality assessment for your organisation",""]
[1,1,{"$f":"VLOOKUP(M6,MMATref,5,FALSE)","v":2},null,"Step 2 - Carry out a cyber security threat analysis, supported by realistic scenarios and rehearsals",null,null,{"$f":"VLOOKUP(M6,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,3,{"$f":"B6&\".\"&VLOOKUP(M6,MMATref,4,FALSE)","v":"1.2"},null,1,"",1,{"$f":"R6","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 2","Carry out a cyber security threat analysis, supported by realistic scenarios and rehearsals",""]
[1,1,{"$f":"VLOOKUP(M7,MMATref,5,FALSE)","v":3},null,"Step 3 - Consider the implications of people, process and technology",null,null,{"$f":"VLOOKUP(M7,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,4,{"$f":"B7&\".\"&VLOOKUP(M7,MMATref,4,FALSE)","v":"1.3"},null,1,"",1,{"$f":"R7","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 3","Consider the implications of people, process and technology",""]
[1,1,{"$f":"VLOOKUP(M8,MMATref,5,FALSE)","v":4},null,"Step 4 - Create an appropriate control environment",null,null,{"$f":"VLOOKUP(M8,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,5,{"$f":"B8&\".\"&VLOOKUP(M8,MMATref,4,FALSE)","v":"1.4"},null,1,"",1,{"$f":"R8","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 4","Create an appropriate control environment",""]
[1,1,{"$f":"VLOOKUP(M9,MMATref,5,FALSE)","v":5},null,"Step 5 - Review your state of readiness in cyber security response",null,null,{"$f":"VLOOKUP(M9,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,6,{"$f":"B9&\".\"&VLOOKUP(M9,MMATref,4,FALSE)","v":"1.5"},null,1,"",1,{"$f":"R9","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 5","Review your state of readiness in cyber security response",""]
[2,"",null,null,"Phase 2 - Respond",null,null,null,null,null,null,"",7,null,null,null,"",null,null,"",null,null,null,null,null,null,null,null,null,null,"Phase 2","Respond",""]
[2,2,{"$f":"VLOOKUP(M11,MMATref,5,FALSE)","v":6},null,"Step 1 - Identify cyber security incident",null,null,{"$f":"VLOOKUP(M11,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,8,{"$f":"B11&\".\"&VLOOKUP(M11,MMATref,4,FALSE)","v":"2.1"},null,1,"",1,{"$f":"R11","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 1","Identify cyber security incident",""]
[2,2,{"$f":"VLOOKUP(M12,MMATref,5,FALSE)","v":7},null,"Step 2 - Define objectives and investigate situation",null,null,{"$f":"VLOOKUP(M12,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,9,{"$f":"B12&\".\"&VLOOKUP(M12,MMATref,4,FALSE)","v":"2.2"},null,1,"",1,{"$f":"R12","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 2","Define objectives and investigate situation",""]
[2,2,{"$f":"VLOOKUP(M13,MMATref,5,FALSE)","v":8},null,"Step 3 - Take appropriate action",null,null,{"$f":"VLOOKUP(M13,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,10,{"$f":"B13&\".\"&VLOOKUP(M13,MMATref,4,FALSE)","v":"2.3"},null,1,"",1,{"$f":"R13","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 3","Take appropriate action",""]
[2,2,{"$f":"VLOOKUP(M14,MMATref,5,FALSE)","v":9},null,"Step 4 - Recover systems, data and connectivity",null,null,{"$f":"VLOOKUP(M14,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,11,{"$f":"B14&\".\"&VLOOKUP(M14,MMATref,4,FALSE)","v":"2.4"},null,1,"",1,{"$f":"R14","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 4","Recover systems, data and connectivity",""]
[3,"",null,null,"Phase 3 - Follow Up",null,null,null,null,null,null,"",12,null,null,null,"",null,null,"",null,null,null,null,null,null,null,null,null,null,"Phase 3","Follow Up",""]
[3,3,{"$f":"VLOOKUP(M16,MMATref,5,FALSE)","v":10},null,"Step 1 - Investigate incident more thoroughly",null,null,{"$f":"VLOOKUP(M16,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,13,{"$f":"B16&\".\"&VLOOKUP(M16,MMATref,4,FALSE)","v":"3.1"},null,1,"",1,{"$f":"R16","v":1},1,null,null,null,null,null,null,null,null,null,null,"Step 1","Investigate incident more thoroughly",""]
[3,3,11,null,"Step 2 - Report incident to relevant stakeholders",null,null,{"$f":"VLOOKUP(M17,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,14,"3.2",null,1,"",1,1,1,null,null,null,null,null,null,null,null,null,null,"Step 2","Report incident to relevant stakeholders",""]
[3,3,12,null,"Step 3 - Carry out a post incident investigation review",null,null,{"$f":"VLOOKUP(M18,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,15,"3.3",null,1,"",1,1,1,null,null,null,null,null,null,null,null,null,null,"Step 3","Carry out a post incident investigation review",""]
[3,3,13,null,"Step 4 - Communicate and build on lessons learned",null,null,{"$f":"VLOOKUP(M19,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,16,"3.4",null,1,"",1,1,1,null,null,null,null,null,null,null,null,null,null,"Step 4","Communicate and build on lessons learned",""]
[3,3,14,null,"Step 5 - Update key information, controls and processes",null,null,{"$f":"VLOOKUP(M20,Configuration!N:AA,14,FALSE)","v":""},null,null,null,0,17,"3.5",null,1,"",1,1,1,null,null,null,null,null,null,null,null,null,null,"Step 5","Update key information, controls and processes",""]
[3,3,15,null,"Step 6 - Perform trend analysis",null,null,{"$f":"VLOOKUP(M21,Configuration!N:AA,14,FALSE)","v":""},null,null,null,1,18,"3.6",null,1,"",1,1,1,null,null,null,null,null,null,null,null,null,null,"Step 6","Perform trend analysis",""]

{"sheet":"Results","index":8,"n_rows":21,"n_cols":35,"rows_kept":21,"cut":false,"hidden":false,"merged":[[1,4,1,5],[1,6,1,7],[0,3,0,17]]}
[null,null,null,{"$f":"\"Aggregated maturity level results\"&IF(LEN(scope_area_of_assessment)=0,\"\",\" for \"&scope_area_of_assessment)","v":"Aggregated maturity level results"}]
[null,null,"Cyber Security Incident Response","Cyber Security Incident Response","Maturity level (1 to 5)",null,"Target maturity (1 to 5)",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"rating","target",1,2,3,1,2,3]
[null,"CSIR",{"$f":"VLOOKUP(B3,'MMAT ref'!A:E,2,FALSE)","v":"Overall"},{"$f":"B3&\" - \"&C3","v":"CSIR - Overall"},{"$f":"VLOOKUP(B3,'MMAT ref'!A:E,4,FALSE)","v":""},{"$f":"IF(ISERROR(E3),\"\",E3)","v":""},{"$f":"H3","v":""},{"$f":"VLOOKUP(B3,'MMAT ref'!A:F,6,FALSE)","v":""}]
[null,{"$f":"'MMAT ref'!AG1","v":1},{"$f":"VLOOKUP(B4,'MMAT ref'!AG:AJ,4,FALSE)","v":"Prepare"},{"$f":"VLOOKUP(B4,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C4","v":"Phase 1 - Prepare"},{"$f":"VLOOKUP(B4,'MMAT ref'!H:K,4,FALSE)","v":""},{"$f":"IF(ISERROR(E4),\"\",E4)","v":""},{"$f":"H4","v":""},{"$f":"VLOOKUP(B4,'MMAT ref'!H:M,6,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q1","v":"1.1"},{"$f":"Z4&\" - \"&VLOOKUP(Z4,textref,4,FALSE)","v":"1.1 - Criticality assessment"},{"$f":"VLOOKUP(Z4,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z4,'MMAT ref'!Q:W,7,FALSE)","v":""},{"$f":"IF(IF(VALUE(LEFT($AA4,1))=AD$2,$AB4,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA4,1))=AD$2,$AB4,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA4,1))=AG$2,$AC4,\"\"))=0,#N/A,IF(VALUE(LEFT($AA4,1))=AG$2,$AC4,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG2","v":"1.1"},{"$f":"VLOOKUP(B5,'MMAT ref'!AG:AJ,4,FALSE)","v":"Criticality assessment"},{"$f":"VLOOKUP(B5,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C5","v":"Step 1 - Criticality assessment"},{"$f":"VLOOKUP(B5,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"IF(ISERROR(E5),\"\",E5)","v":""},{"$f":"H5","v":""},{"$f":"VLOOKUP(B5,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q2","v":"1.2"},"1.2 - Threat analysis",{"$f":"VLOOKUP(Z5,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z5,'MMAT ref'!Q:W,7,FALSE)","v":""},{"$f":"IF(IF(VALUE(LEFT($AA5,1))=AD$2,$AB5,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA5,1))=AD$2,$AB5,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA5,1))=AG$2,$AC5,\"\"))=0,#N/A,IF(VALUE(LEFT($AA5,1))=AG$2,$AC5,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG3","v":"1.2"},{"$f":"VLOOKUP(B6,'MMAT ref'!AG:AJ,4,FALSE)","v":"Threat analysis"},{"$f":"VLOOKUP(B6,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C6","v":"Step 2 - Threat analysis"},{"$f":"VLOOKUP(B6,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"IF(ISERROR(E6),\"\",E6)","v":""},{"$f":"H6","v":""},{"$f":"VLOOKUP(B6,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q3","v":"1.3"},"1.3 - People, Process, Technology and Information",{"$f":"VLOOKUP(Z6,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z6,'MMAT ref'!Q:W,7,FALSE)","v":""},{"$f":"IF(IF(VALUE(LEFT($AA6,1))=AD$2,$AB6,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA6,1))=AD$2,$AB6,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA6,1))=AG$2,$AC6,\"\"))=0,#N/A,IF(VALUE(LEFT($AA6,1))=AG$2,$AC6,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG4","v":"1.3"},{"$f":"VLOOKUP(B7,'MMAT ref'!AG:AJ,4,FALSE)","v":"People, Process, Technology and Information"},{"$f":"VLOOKUP(B7,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C7","v":"Step 3 - People, Process, Technology and Information"},{"$f":"VLOOKUP(B7,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"IF(ISERROR(E7),\"\",E7)","v":""},{"$f":"H7","v":""},{"$f":"VLOOKUP(B7,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q4","v":"1.4"},"1.4 - Control environment",{"$f":"VLOOKUP(Z7,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z7,'MMAT ref'!Q:W,7,FALSE)","v":""},{"$f":"IF(IF(VALUE(LEFT($AA7,1))=AD$2,$AB7,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA7,1))=AD$2,$AB7,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA7,1))=AG$2,$AC7,\"\"))=0,#N/A,IF(VALUE(LEFT($AA7,1))=AG$2,$AC7,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG5","v":"1.4"},{"$f":"VLOOKUP(B8,'MMAT ref'!AG:AJ,4,FALSE)","v":"Control environment"},{"$f":"VLOOKUP(B8,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C8","v":"Step 4 - Control environment"},{"$f":"VLOOKUP(B8,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B8,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q5","v":"1.5"},"1.5 - Maturity assessment",{"$f":"VLOOKUP(Z8,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z8,'MMAT ref'!Q:W,7,FALSE)","v":""},{"$f":"IF(IF(VALUE(LEFT($AA8,1))=AD$2,$AB8,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA8,1))=AD$2,$AB8,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA8,1))=AG$2,$AC8,\"\"))=0,#N/A,IF(VALUE(LEFT($AA8,1))=AG$2,$AC8,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG6","v":"1.5"},{"$f":"VLOOKUP(B9,'MMAT ref'!AG:AJ,4,FALSE)","v":"Maturity assessment"},{"$f":"VLOOKUP(B9,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C9","v":"Step 5 - Maturity assessment"},{"$f":"VLOOKUP(B9,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B9,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q6","v":"2.1"},"2.1 - Identification",{"$f":"VLOOKUP(Z9,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z9,'MMAT ref'!Q:W,7,FALSE)","v":""},null,{"$f":"IF(IF(VALUE(LEFT($AA9,1))=AE$2,$AB9,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA9,1))=AE$2,$AB9,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA9,1))=AH$2,$AC9,\"\"))=0,#N/A,IF(VALUE(LEFT($AA9,1))=AH$2,$AC9,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG7","v":2},{"$f":"VLOOKUP(B10,'MMAT ref'!AG:AJ,4,FALSE)","v":"Respond"},{"$f":"VLOOKUP(B10,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C10","v":"Phase 2 - Respond"},{"$f":"VLOOKUP(B10,'MMAT ref'!H:K,4,FALSE)","v":""},{"$f":"IF(ISERROR(E10),\"\",E10)","v":""},{"$f":"H10","v":""},{"$f":"VLOOKUP(B10,'MMAT ref'!H:M,6,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q7","v":"2.2"},"2.2 - Investigation",{"$f":"VLOOKUP(Z10,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z10,'MMAT ref'!Q:W,7,FALSE)","v":""},null,{"$f":"IF(IF(VALUE(LEFT($AA10,1))=AE$2,$AB10,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA10,1))=AE$2,$AB10,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA10,1))=AH$2,$AC10,\"\"))=0,#N/A,IF(VALUE(LEFT($AA10,1))=AH$2,$AC10,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG8","v":"2.1"},{"$f":"VLOOKUP(B11,'MMAT ref'!AG:AJ,4,FALSE)","v":"Identification"},{"$f":"VLOOKUP(B11,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C11","v":"Step 1 - Identification"},{"$f":"VLOOKUP(B11,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B11,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q8","v":"2.3"},"2.3 - Action",{"$f":"VLOOKUP(Z11,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z11,'MMAT ref'!Q:W,7,FALSE)","v":""},null,{"$f":"IF(IF(VALUE(LEFT($AA11,1))=AE$2,$AB11,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA11,1))=AE$2,$AB11,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA11,1))=AH$2,$AC11,\"\"))=0,#N/A,IF(VALUE(LEFT($AA11,1))=AH$2,$AC11,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG9","v":"2.2"},{"$f":"VLOOKUP(B12,'MMAT ref'!AG:AJ,4,FALSE)","v":"Investigation"},{"$f":"VLOOKUP(B12,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C12","v":"Step 2 - Investigation"},{"$f":"VLOOKUP(B12,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B12,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q9","v":"2.4"},"2.4 - Recovery",{"$f":"VLOOKUP(Z12,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z12,'MMAT ref'!Q:W,7,FALSE)","v":""},null,{"$f":"IF(IF(VALUE(LEFT($AA12,1))=AE$2,$AB12,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA12,1))=AE$2,$AB12,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA12,1))=AH$2,$AC12,\"\"))=0,#N/A,IF(VALUE(LEFT($AA12,1))=AH$2,$AC12,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG10","v":"2.3"},{"$f":"VLOOKUP(B13,'MMAT ref'!AG:AJ,4,FALSE)","v":"Action"},{"$f":"VLOOKUP(B13,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C13","v":"Step 3 - Action"},{"$f":"VLOOKUP(B13,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B13,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q10","v":"3.1"},"3.1 - Incident investigation",{"$f":"VLOOKUP(Z13,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z13,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,{"$f":"IF(IF(VALUE(LEFT($AA13,1))=AF$2,$AB13,\"\")=\"\",#N/A,IF(VALUE(LEFT($AA13,1))=AF$2,$AB13,\"\"))","v":{"$error":"#N/A"}},null,null,{"$f":"IF(LEN(IF(VALUE(LEFT($AA13,1))=AI$2,$AC13,\"\"))=0,#N/A,IF(VALUE(LEFT($AA13,1))=AI$2,$AC13,\"\"))","v":{"$error":"#N/A"}}]
[null,{"$f":"'MMAT ref'!AG11","v":"2.4"},{"$f":"VLOOKUP(B14,'MMAT ref'!AG:AJ,4,FALSE)","v":"Recovery"},{"$f":"VLOOKUP(B14,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C14","v":"Step 4 - Recovery"},{"$f":"VLOOKUP(B14,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B14,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q11","v":"3.2"},"3.2 - Reporting",{"$f":"VLOOKUP(Z14,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z14,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,{"$error":"#N/A"},null,null,{"$error":"#N/A"}]
[null,{"$f":"'MMAT ref'!AG12","v":3},{"$f":"VLOOKUP(B15,'MMAT ref'!AG:AJ,4,FALSE)","v":"Follow up"},{"$f":"VLOOKUP(B15,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C15","v":"Phase 3 - Follow up"},{"$f":"VLOOKUP(B15,'MMAT ref'!H:K,4,FALSE)","v":""},{"$f":"IF(ISERROR(E15),\"\",E15)","v":""},{"$f":"H15","v":""},{"$f":"VLOOKUP(B15,'MMAT ref'!H:M,6,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q12","v":"3.3"},"3.3 - Post incident review",{"$f":"VLOOKUP(Z15,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z15,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,{"$error":"#N/A"},null,null,{"$error":"#N/A"}]
[null,{"$f":"'MMAT ref'!AG13","v":"3.1"},{"$f":"VLOOKUP(B16,'MMAT ref'!AG:AJ,4,FALSE)","v":"Incident investigation"},{"$f":"VLOOKUP(B16,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C16","v":"Step 1 - Incident investigation"},{"$f":"VLOOKUP(B16,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B16,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q13","v":"3.4"},"3.4 - Lessons learned",{"$f":"VLOOKUP(Z16,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z16,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,{"$error":"#N/A"},null,null,{"$error":"#N/A"}]
[null,{"$f":"'MMAT ref'!AG14","v":"3.2"},{"$f":"VLOOKUP(B17,'MMAT ref'!AG:AJ,4,FALSE)","v":"Reporting"},{"$f":"VLOOKUP(B17,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C17","v":"Step 2 - Reporting"},{"$f":"VLOOKUP(B17,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B17,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q14","v":"3.5"},"3.5 - Updating",{"$f":"VLOOKUP(Z17,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z17,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,{"$error":"#N/A"},null,null,{"$error":"#N/A"}]
[null,{"$f":"'MMAT ref'!AG15","v":"3.3"},{"$f":"VLOOKUP(B18,'MMAT ref'!AG:AJ,4,FALSE)","v":"Post incident review"},{"$f":"VLOOKUP(B18,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C18","v":"Step 3 - Post incident review"},{"$f":"VLOOKUP(B18,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B18,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"'MMAT ref'!Q15","v":"3.6"},"3.6 - Trend analysis",{"$f":"VLOOKUP(Z18,'MMAT ref'!Q:R,2,FALSE)","v":""},{"$f":"VLOOKUP(Z18,'MMAT ref'!Q:W,7,FALSE)","v":""},null,null,{"$error":"#N/A"},null,null,{"$error":"#N/A"}]
[null,{"$f":"'MMAT ref'!AG16","v":"3.4"},{"$f":"VLOOKUP(B19,'MMAT ref'!AG:AJ,4,FALSE)","v":"Lessons learned"},{"$f":"VLOOKUP(B19,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C19","v":"Step 4 - Lessons learned"},{"$f":"VLOOKUP(B19,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B19,'MMAT ref'!Q:W,7,FALSE)","v":""}]
[null,{"$f":"'MMAT ref'!AG17","v":"3.5"},{"$f":"VLOOKUP(B20,'MMAT ref'!AG:AJ,4,FALSE)","v":"Updating"},{"$f":"VLOOKUP(B20,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C20","v":"Step 5 - Updating"},{"$f":"VLOOKUP(B20,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B20,'MMAT ref'!Q:W,7,FALSE)","v":""}]
[null,{"$f":"'MMAT ref'!AG18","v":"3.6"},{"$f":"VLOOKUP(B21,'MMAT ref'!AG:AJ,4,FALSE)","v":"Trend analysis"},{"$f":"VLOOKUP(B21,'MMAT ref'!AG:AI,2,FALSE)& \" - \"&C21","v":"Step 6 - Trend analysis"},{"$f":"VLOOKUP(B21,'MMAT ref'!Q:R,2,FALSE)","v":""},"","",{"$f":"VLOOKUP(B21,'MMAT ref'!Q:W,7,FALSE)","v":""}]