A twenty-item, self-reported local checklist across five pillars. Scores describe selected answers, not inspected systems, verified maturity, active monitoring or security certification.