Organizational vulnerability
The organization's own self-assessment — the supplier questionnaire, pointed inward.
Assessing yourself
Organizational vulnerability is your organization answering the same questionnaire it sends to suppliers. The result is your own maturity in cyber, privacy, and continuity — and it is what enters as the vulnerability component in every asset's risk calculation.
Without this self-assessment the cyber risk matrix does not close: vulnerability is one of the formula's required inputs. That is why it tends to be among the first things to do, even with an empty supplier portfolio.
Why it is a separate screen
The self-assessment lives outside the supplier assessment list, and not for visual tidiness. It has no supplier, no external respondent, and does not use the tokenized invite flow — whoever answers is already authenticated on the platform. Mixing the two into one list would force every column to mean two things.
What it feeds
Beyond the cyber matrix, the self-assessment is the basis for auto-filling the CAIQ and for reading adherence per regulatory requirement. Answering once serves three screens — which also means a stale self-assessment ages all three together.