Skip to main content

2 - Incident Response Self-Assessment Scorecard (0-30)

A quantitative framework for evaluating how well your organization can detect, investigate, and resolve security incidents.

Overview​

Most organizations believe they are “reasonably prepared” for security incidents - until a real event occurs. That’s when the weaknesses surface:

  • Missing logs
  • Slow video retrieval
  • No consistent workflow
  • Elevators not accounted for
  • Alarms not correlated
  • No unified timeline
  • Operators improvising under pressure

The Incident Response Self-Assessment Scorecard gives you a measurable way to assess your current readiness across six critical categories. The goal is not perfection - it’s clarity.

This scorecard helps you define where you are today, where gaps exist, and which areas will have the biggest impact if improved.

How to Use This Scorecard​

  • Complete it with your team - Security, FM, IT, and your integrator.
  • Answer honestly, based on actual workflows (not policy documents).
  • Assign a score from 0 to 5 for each category.
  • Use the totals to populate your Incident Response Gap Map (Article 7).
  • Reassess quarterly or after major system upgrades.

Each category includes details, examples, and symptoms of low readiness to help guide your scoring.

CATEGORY A - Real-Time Monitoring (0-5)​

Do you have immediate visibility into what’s happening right now?

Security teams should be able to see:

  • Access events
  • Live video
  • Elevator states
  • Alarms
  • Alerts
  • Device health

High Readiness (4-5):

  • Access, video, elevator, and alarms monitored from a single UI.
  • Operators receive contextual alerts automatically.
  • Cloud redundancy and multi-site failover protect uptime.
  • Device health and offline alerts appear instantly.

Medium Readiness (2-3):

  • Some unified monitoring; other systems require manual checks.
  • Operators rely on separate UIs for video and access.
  • Limited automated alerting.

Low Readiness (0-1):

  • Everything is siloed.
  • Teams switch between multiple consoles.
  • Incidents often go unnoticed until something escalates.

Score: ____ / 5

CATEGORY B - Detection & Triggering (0-5)​

Does your system automatically detect incidents in progress?

Key capabilities include:

  • Automatic snapshots on access or pedestrian events
  • Behavior and object detection via AI
  • Motion, intrusion, or exception triggers
  • Bookmarking of videos at the moment of an incident

High Readiness (4-5):

  • Events in access, elevators, video, and alarms automatically trigger recorded artifacts.
  • AI filters noise and prioritizes meaningful anomalies.
  • Operators receive consolidated alerts with context.

Medium Readiness (2-3):

  • Some triggers exist (motion, access denied).
  • Video bookmarking is partially automated.
  • AI analytics may exist but are not integrated.

Low Readiness (0-1):

  • No automation - operators must manually review feeds.
  • No correlation between systems.

Score: ____ / 5

CATEGORY C - Evidence Collection (0-5)​

How quickly can you gather logs, video, snapshots, and elevator events?

During an incident, evidence often lives in:

  • Access control logs
  • NVRs / VMS
  • Elevator dispatch logs
  • Intrusion and alarm systems
  • Video analytics
  • Operator notes

High Readiness (4-5):

  • All evidence sources can be retrieved within minutes.
  • Logs and video correlate automatically.
  • Snapshots and ROIs are generated at the moment of the event.
  • Operators do not manually export or align timestamps.

Medium Readiness (2-3):

  • Access logs and video are available but require manual correlation.
  • Elevator logs must be requested separately.
  • Investigators spend 1-2 hours gathering evidence.

Low Readiness (0-1):

  • Everything is manual.
  • Investigations take days.
  • Evidence is often incomplete or missing.

Score: ____ / 5

CATEGORY D - Investigation Workflow (0-5)​

Is there a consistent, repeatable workflow your team follows?

During investigations, your team should be able to answer:

  • What triggered the incident?
  • Where did the person or event originate?
  • What path did they take?
  • What devices were involved?
  • What security actions were taken?

High Readiness (4-5):

  • Well-documented, standardized workflows.
  • Operators follow the same steps every time.
  • Handoff to HR, Legal, or Responder teams is structured.
  • No gaps or improvisation.

Medium Readiness (2-3):

  • Workflow exists but is inconsistently applied.
  • Operators rely on personal experience.
  • Documentation exists but is not integrated into tools.

Low Readiness (0-1):

  • Investigations differ every time.
  • No standard process.
  • Operators rebuild workflows from scratch during crises.

Score: ____ / 5

CATEGORY E - Post-Incident Reporting (0-5)​

Can you deliver a complete, audit-ready incident report quickly?

A full incident report includes:

  • Timeline
  • Video and snapshots
  • Elevator and access events
  • Behavior analytics
  • Alarm activity
  • Narrative summary
  • Corrective actions

High Readiness (4-5):

  • Complete incident bundles generated automatically.
  • Reports delivered to leadership within hours.
  • Consistent format used across all incidents.

Medium Readiness (2-3):

  • Reports created manually.
  • Operators often forget to include key evidence.
  • Timelines require manual alignment.

Low Readiness (0-1):

  • No defined reporting format.
  • Reports vary by operator.
  • Evidence often missing or delayed.

Score: ____ / 5

CATEGORY F - Continuity & Resilience (0-5)​

Can your security systems operate during outages or disruptions?

Key capabilities include:

  • Cloud failover
  • Offline modes for access control
  • Geographically distributed backups
  • Automatic redundancy

High Readiness (4-5):

  • Cloud-native infrastructure with automatic failover.
  • Local hardware outages do not impact core operations.
  • Records and logs remain intact during disruptions.

Medium Readiness (2-3):

  • Some redundancy available.
  • Certain systems fail during outages.

Low Readiness (0-1):

  • Outages stop monitoring and evidence collection entirely.
  • No continuity plan.
  • Incident response halts when local systems fail.

Score: ____ / 5

TOTAL READINESS SCORE: ____ / 30​

Interpretation Guide

  • 26-30: Excellent - Your environment is modern, automated, and resilient.
  • 20-25: Good - Several improvements will dramatically boost readiness.
  • 10-19: Moderate Risk - Manual processes slow investigations and increase liability.
  • 0-9: High Risk - Response depends on luck and staff experience.

Next Step​

Move on to Article 3: The 7 Essential Evidence Sources, where you’ll learn what evidence is required to form a complete, defensible incident record - and why many teams miss critical components.