Free to use
Five free readiness tools that run entirely in your browser.
Indicative readiness checks for CPS 230, NIST CSF 2.0, ISO/IEC 27001 and ISO/IEC 42001, and an EU AI Act risk-tier classifier. Your answers stay on your device. If you want our view, each result drafts an email for you to edit and send yourself.
These tools are built and run in your browser, so they do nothing with JavaScript disabled. Tell us what you are assessing at contact@4tadvisory.com and we will walk you through the same questions.
CPS 230 readiness check
25 questions across governance, the risk profile and controls, incidents and notification, business continuity and service providers. Every obligation group in APRA's standard as in force from 1 July 2026 is represented by at least one question. A weak area caps the band, because strength elsewhere does not offset it.
NIST CSF 2.0 cyber readiness check
22 questions, one for each Category across the six Functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. Each question samples its Category's outcomes.
ISO/IEC 27001 readiness check
20 questions mapped to each main clause from 4 to 10, including the 2024 climate change amendment, and to each of the four Annex A control themes.
ISO/IEC 42001 readiness check
21 questions mapped to each main clause from 4 to 10, including the AI system impact assessment, and to each of the nine Annex A control areas.
EU AI Act risk-tier classifier
A branching set of questions about one AI use case, covering the AI system definition, scope, your role, prohibited practices (including those applying from December 2026), both high-risk routes and the Article 6(3) exception, transparency duties and general-purpose AI models, with application dates as amended in 2026.
Every tool gives an indicative view to start a conversation. None is advice, an audit, a certification or a compliance determination. Nothing you enter is stored or sent by this site. Questions are written in our own words; they summarise the frameworks and do not reproduce them.