Basic assessment information
Only the basic profile is needed for the assessment and executive report. The optional charter and trigger details below are available for businesses or practitioners that want a more formal file.
Assessment profile
Optional engagement / internal-use charter and trigger notes
Engagement / internal-use charter
Optional business trigger notes
You do not need to complete this table to use the Federal / Jurisdiction register. It is available only if you want to keep additional background facts in the assessment file.
| Trigger area | Facts / business profile | Trigger met? | Evidence / ER IDs | Review / referral | Notes |
|---|
How to complete FORTIFY correctly
Use this section while assessing. The platform is intentionally simple: determine applicability, select the current maturity, assign priority, assess inherent risk, and choose practical recommendations when improvement is needed.
Six practical steps
The platform is designed to move from facts and evidence to ratings, actions, and validation—not from a desired score backward.
Frame
Confirm the business, scope, industry, jurisdictions, and any obvious legal or operational issues that need immediate attention.
Understand the current process
Ask how the process works today, look at the records or system used, and note material exceptions or dependencies before selecting a maturity level.
Check legal applicability
Use the Federal / Jurisdiction register only for requirements that can actually affect the business. Mark each item Watch, Applicable, Not Applicable, or Uncertain.
Rate simply
For each applicable component, select only four assessment inputs: current maturity, priority, and inherent risk, alongside applicability.
Select improvements
Select as many recommendations as are useful. A fully mature M4 process may be left without a recommendation when no further improvement is warranted.
Use the action plan
The platform automatically builds the improvement plan from selected recommendations. Supporting implementation or validation records are optional, not additional required work.
Rating scales
Use the definitions below directly when selecting the current state and priority. The platform does not force a complex scoring model behind these judgments.
Maturity — M0 to M4
Capability and operating evidence.
Priority — P0 to P4
Urgency and sequencing.
Two simple supporting judgments
Use these definitions consistently; neither requires a separate scoring worksheet.
Inherent risk
- Low: limited consequence if the process fails.
- Moderate: noticeable financial, compliance, customer, or operating consequence.
- High: material consequence or recurring exposure requiring management attention.
- Critical: potential severe legal, payroll, fraud, safety, cyber/data, liquidity, or continuity consequence.
Federal / jurisdiction status
- Watch: review the requirement because its trigger may apply now or later.
- Applicable: the business is subject to the requirement and should maintain the stated records/process.
- Not Applicable: the requirement does not apply based on current facts.
- Uncertain: applicability is unclear and should be referred or confirmed.
R1–R10 categories
R2 Operating standard
R3 Evidence and retention
R4 Preventive / detective control
R5 Technology / data support
R7 Practitioner action
R8 Validation and monitoring
R9 Targeted improvement
R10 Federal / jurisdiction alignment
Select as many recommendations as are useful. If a component is fully mature at M4 and no additional improvement is needed, no recommendation is required.
64-component assessment
Each component uses only four assessment inputs: Applicability, Current State (M0–M4), Priority (P0–P4), and Inherent Risk. The framework guidance, practical test, evidence cues, and relevant legal/regulatory checks are shown to help the user make those judgments.
Practical requirements that may affect the business
This register intentionally excludes congressional policy statements, research evidence, and general program references that do not require the business to do anything. For each item, read When this applies and What the business should have or do, then choose Watch, Applicable, Not Applicable, or Uncertain.
No additional entry is required here
The action plan below is created automatically from the maturity, priority, inherent-risk, and recommendation selections in the Core Assessment and Industry Questionnaire. A business can use FORTIFY without completing separate evidence, implementation, validation, partner, or source logs.
Automatically derived actions
Optional supporting records — use only when additional documentation is useful
Master Evidence Register
Implementation & training record
Validation log
Partner / cohort quality file
Source & change log
Maturity by domain
Risk distribution
This is the inherent risk selected by the assessor before considering the strength of the current process.
Applicability and sector summary
Management summary
Atrevia FORTIFY Executive Assessment Report
Export assessment data
Download a JSON backup containing the profile, component ratings, selected recommendations, federal register, industry questionnaire, and any optional supporting records.
Import assessment data
Import a backup generated by this revised platform. Import replaces the current local assessment after confirmation.
Reset this device
This removes only the locally stored revised-platform assessment. It does not alter the HTML file itself.