Skip to content
APAC NRENCyber Readiness Benchmark

Method

Framework and method

Every NREN is assessed in 7 operational security domains. Each domain gets a maturity level from 1 to 5, and the levels are combined into a Readiness Index from 0 to 100. The framework is rooted in the GÉANT Security Baseline and ENISA models, adapted for lower-resourced Asia-Pacific NRENs and validated with the community at APAN62.
Try the free self-assessment How the index is calculated

The scale

Maturity levels

Each domain, and the benchmark as a whole, is placed on the same five-level scale.

  1. 1

    Initial

    Almost nothing in place. Responses are ad hoc and unpredictable.

  2. 2

    Developing

    Some capability exists but is inconsistent and undocumented.

  3. 3

    Defined

    Processes are written down, approved, and followed consistently.

  4. 4

    Managed

    Processes are measured, tracked, reported, and tested regularly.

  5. 5

    Optimising

    Continuously improving based on data, feedback, and external audit.

What is measured

The 7 domains

Open a domain to see what each maturity level looks like in practice, and the standards it draws on.

Domain 1Governance & Policy

Who owns security decisions, whether there is a budget, and whether risk is tracked or assumed.

  • GÉANT Security Baseline
  • ISO/IEC 27001
  • NIST CSF 2.0
  1. 1InitialNamed security mandate-holder; information security policy in some form
  2. 2DevelopingManagement-approved policy; security function identified; risk assessment and budget
  3. 3DefinedFormally approved risk strategy with review cadence; policy covers legal and regulatory obligations
  4. 4ManagedBoard-approved policy and risk appetite; KPIs and governance reporting; internal audit
  5. 5OptimisingFull ISMS with management review and certified external audit; third-party risk programme
Domain 2Monitoring & Observability

Day-to-day visibility into what is happening on the network: logging, alerting and NOC coverage.

  • GÉANT CBP monitoring guides
  • NetFlow/IPFIX
  • SIEM/SOC tooling
  • CIS Controls
  1. 1InitialNo structured log collection or network monitoring
  2. 2DevelopingBasic firewall/IDS alerts only; reactive and signature-based; no flow collection
  3. 3DefinedNetFlow/IPFIX collection; centralised log aggregation; defined NOC model
  4. 4ManagedReal-time anomaly detection; segmented, documented topology; 24/7 IDS/IPS; forensic log retention
  5. 5OptimisingML-driven behavioural profiling; automated SIEM/SOC; continuous vulnerability scanning
Domain 3Incident Response & CSIRT Capability

How prepared the team is to detect, contain, and learn from a security incident.

  • FIRST CSIRT Services Framework
  • ENISA SIM3
  • Trusted Introducer
  • NIST SP 800-61
  1. 1InitialNo formal incident response; fully ad hoc
  2. 2DevelopingIncident intake with basic triage; classification scheme; named authority notified
  3. 3DefinedDocumented response plan with root-cause analysis and containment; Trusted Introducer Listed
  4. 4Managed24/7 CSIRT watch desk; forensic capability; national CSIRT coordination; TI Accredited
  5. 5OptimisingTI Certified (audited); crisis management support; external CSIRT peer coordination
Domain 4Routing & DNS Security

Two specific technical safeguards: RPKI (routing security) and DNSSEC (DNS security).

  • RPKI/ROV (Gilad et al.)
  • RFC 4033 DNSSEC
  • MANRS
  • Internet2 Routing Integrity
  1. 1InitialNo RPKI, IRR or DNSSEC
  2. 2DevelopingIRR objects maintained; basic BGP prefix filters
  3. 3DefinedRPKI ROAs for all prefixes; DNSSEC zone signing operational
  4. 4ManagedROV enforced (invalid routes rejected); DNSSEC full chain of trust with validation
  5. 5OptimisingASPA deployed; DNSSEC KSK rollover tested; automated route filtering
Domain 5Trusted Access Services

How people log in, whether MFA holds up, and how access is controlled and reviewed.

  • MFA
  • REFEDS assurance profiles
  • eduGAIN Constitution
  • Sirtfi
  1. 1InitialNo MFA; shared or default credentials; no federation
  2. 2DevelopingMFA for administrative accounts; basic access control
  3. 3DefinedSAML IdP in national federation and eduGAIN; documented attribute release policy
  4. 4ManagedREFEDS CoCo and Sirtfi; RAF Espresso; segregation of duties
  5. 5OptimisingPhishing-resistant MFA; zero-trust access; regular access reviews; R&S entity category
Domain 6Continuity Planning & Operational Resilience

Whether critical services keep running, or recover quickly, when something goes wrong.

  • GÉANT S7 BCM Framework
  • ISO 22301
  • GÉANT CLAW
  1. 1InitialNo BCP or BIA; ad hoc responses to disruption
  2. 2DevelopingBasic backups and recovery awareness; contact list maintained
  3. 3DefinedBIA with named RTO/RPO; management-approved BCP; named crisis team
  4. 4ManagedBCP exercised annually; dependency mapping; vendor continuity; succession of authority
  5. 5OptimisingFull S7 / ISO 22301 implementation; board-level review; crisis simulation participation
Domain 7Institutional Coordination

How connected the NREN is to the wider regional cybersecurity community.

  • APCERT
  • FIRST
  • Trusted Introducer
  • MISP / ISAC models
  • ENISA SIM3 P-17
  1. 1InitialNo participation in any coordination network; informal sharing only
  2. 2DevelopingInformal, bilateral relationship with the national CSIRT; TLP-based sharing
  3. 3DefinedFormal national CSIRT liaison; FIRST or APCERT member; annual cyber drill
  4. 4ManagedMoU with national CSIRT; structured threat sharing (MISP); working-group participation
  5. 5OptimisingLeadership roles (APCERT/FIRST SIGs); coordinated vulnerability disclosure; R&E ISAC membership

How it is measured

Four evidence streams

Self-reported answers alone tend to overstate security. The benchmark triangulates four sources (explanatory sequential mixed methods).

  • Stream 1Structured survey19 scored questions across the 7 domains, answered by up to three people per NREN (Director/CEO, Technical Lead, NOC/CSIRT Lead).
  • Stream 2Technical verificationPassive checks of public registries (RPKI, ROV, DNSSEC, FIRST, APCERT, Trusted Introducer, eduGAIN) that cannot be self-reported away.
  • Stream 3Document reviewPolicies, plans and logs shared by NRENs are checked against the survey claim they support.
  • Stream 4InterviewsSemi-structured interviews with NREN leaders and staff explain the numbers and test surprising results.

Scoring

How the Readiness Index is calculated

  1. 1

    Each answer is a statement that maps to a maturity level from 1 to 5.

  2. 2

    Domain level = the average of that domain's answered questions. A blank or “don't know” is left out, not counted as Level 1.

  3. 3

    Readiness Index = the equal average of the seven domain scores. Each domain score is its average level multiplied by 20. The overall score appears only when every domain has at least one answer; Level 1 gives 20/100 and Level 5 gives 100/100.

  4. 4

    Answers that public data can check are marked verified once the project team confirms them. Verified and self-reported results are shown differently on scorecards.

  5. 5

    NRENs update their answers in the portal every year, with evidence. Scores change only after the project team reviews the update, and can go down too, for example when a certification lapses.

Independent evidence

Public technical checks

All checks are passive look-ups of public registries; no NREN system is ever scanned.

CheckDomainPublic source
RPKI: ROAs cover the NREN's announced prefixes Routing & DNSbgp.he.net / RIPEstat
ROV: invalid routes are filtered Routing & DNSAPNIC Labs RPKI statistics
DNSSEC on the NREN's own domain Routing & DNSDNSViz
FIRST membership Coordinationfirst.org/members/teams
APCERT membership Coordinationapcert.org members
Trusted Introducer listing / accreditation Incident Responsetrusted-introducer.org directory
eduGAIN federation and NREN identity provider Trusted Accesstechnical.edugain.org

Improving

Phased resilience roadmap

Every recommendation is placed on one of four stages, from free quick wins to long-term maturity.

  1. 1

    0–3 months

    Quick wins

    Fix critical gaps that cost nothing: write policies, assign responsibilities.

  2. 2

    3–12 months

    Building up

    Develop proper processes and basic monitoring tools.

  3. 3

    1–2 years

    Strengthening

    Invest in monitoring systems and incident response capability.

  4. 4

    2+ years

    Maturing

    Optimise, measure continuously, lead regional coordination.

Method 2026.workbook.1

Final workbook method: each domain is the mean of its answered question levels, multiplied by 20. The overall score is the equal average of the seven domain scores and appears only when every domain has an answer. Verification does not change the score.

If the method changes, past scores are recalculated with the new method so years stay comparable, and the change is explained here.