> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/msi/run-a-maturity-assessment.md). # Measure your program A maturity assessment scores how mature your device's cybersecurity program is, category by category, and shows where to focus next. You can answer the questionnaire yourself, or let MSI fill it in from your device's documents and then review its answers. ## Before you begin * Select the device to assess. See [Find your way around MSI](/msi/get-started.md#switch-organization-workspace-or-device). * Your organization's plan must include Maturity Assessment. * For an automatic assessment, MSI must have finished reading the device's documents. Check the status on **Device Knowledge**. See [Review and correct device knowledge](/msi/review-and-correct-device-knowledge.md). ## Start an assessment 1. In the sidebar, under Activities, select **Maturity Assessment**. * If the device has no assessments yet, the **Cybersecurity Maturity Assessment** form opens. * If it already has one, the latest opens. To start another, open the assessment selector at the top of the page and select **+ New Assessment**. 2. Check the device and the **Version** shown. The assessment is created for that version of the device. 3. Under **Select Assessment Type**, choose one: * **Automatic assessment:** MSI reads the device's documents and fills in the answers for you to review. * **Manual assessment:** you answer every question yourself. 4. Select **Start Assessment**. If the device's documents haven't finished processing, the form says the device knowledge isn't ready and links you to it. Manual assessments don't need it. If you already have an assessment in progress for the device, the form says **You have an assessment in progress**. Select **Resume** to continue it instead of starting over. ## Answer the questionnaire In a manual assessment, MSI shows one question at a time, labeled with its category. 1. Choose one of the three answers, or **Not applicable**. You can also press **1** to **4** on your keyboard. 2. Select **Next** to go on, or **Back** to return to the previous question. 3. To revisit an earlier question, select its step in the progress bar. Your progress is saved automatically, so you can leave and come back. To return to an in-progress assessment, select it in the assessment selector, or select **Resume** on the results page. ## Review an automatic assessment An automatic assessment runs in the background. When it's complete, the results open. MSI marks categories it wants a person to check with **Needs review**. 1. In the category table, select the arrow on a category's row to open its questions. 2. For each question, check the selected answer. MSI shows its confidence (**High**, **Medium** or **Low**) on the answer it chose. 3. Under **Source document(s)**, check the document and page MSI cited. Change the sources if needed. 4. Change any answer that's wrong. 5. Select **Save**, or **Save and mark as reviewed** for a category marked **Needs review**. You can open and edit any category of a completed assessment the same way, whether it was automatic or manual. ## Understand the results | Element | What it shows | | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Maturity Score** | Your overall score. Higher is better. The marker on the gauge shows the industry benchmark, when one is available. | | Category table | Each security category with its **MATURITY SCORE** and how its answers are spread across **LOW**, **MED**, **HIGH** and **N/A**. | | **RECS** | Select the lightbulb (**View recommendations**) for suggestions on improving that category. | | **Design control (Quality management system)** | A diagram that maps your device's security posture to a framework, based on your most recent assessment. Choose **JSP2** (the Health Sector Coordinating Council's Medical Device and Health IT Joint Security Plan) or **IEC81001** (IEC 81001-5-1, the international standard for health software security across its lifecycle). | {% hint style="info" %} On a free plan, only the **Vulnerability & EOL/EOS Management** category's details are shown. Other category names are hidden. {% endhint %} ## Download generated documents MSI generates documents from a completed assessment, such as the MDS2 form (the Manufacturer Disclosure Statement for Medical Device Security that healthcare customers ask for), a labeling guide and a gap analysis report. 1. On the results page, select **View Generated Documents**. 2. Select the download button for the document you need. Documents can take a little while to generate. The list updates on its own. ## Compare assessments over time Run a new assessment whenever your program changes, for example after a release or a process improvement. Each assessment is kept. Open the assessment selector at the top of the page to switch between them; each is listed by date with **Status: Complete** or **Status: In progress**. ## Next steps * [Generate submission documents](/msi/check-estar-readiness/generate-submission-documents.md): produce the rest of your submission package. * [Find and close compliance gaps](/msi/check-estar-readiness/find-and-close-compliance-gaps.md): act on the weaknesses the assessment found. * [Understand your dashboard](/msi/get-started/understand-your-dashboard.md): see your maturity score alongside the rest of the device's status.