English | Deutsch
Active Cyber Program (ACP) is a cybersecurity assessment and certification framework designed to evaluate whether an organization operates an active and effective cybersecurity program.
The ACP framework focuses on verifying that cybersecurity is not only implemented but actively managed across governance, operational processes, and technical infrastructure.
The framework provides organizations with a structured method to evaluate, improve, and demonstrate their cybersecurity capabilities.
Current framework version:
ACP Framework Version 1.6
See the following files for version information:
VERSIONCHANGELOG.md
Many organizations deploy security technologies but lack a structured and actively managed cybersecurity program.
The Active Cyber Program (ACP) helps organizations:
- establish structured cybersecurity governance
- manage cyber risks effectively
- implement operational security processes
- strengthen technical protection mechanisms
- continuously improve cybersecurity maturity
The framework provides a practical and scalable approach suitable for organizations of different sizes and industries.
Organizations that successfully meet the ACP requirements may receive the:
Active Cyber Program (ACP) Certification
The certification confirms that the organization operates a structured and actively managed cybersecurity program.
Certified organizations may use the ACP Trust Label to demonstrate cybersecurity commitment to customers and partners.
The ACP Certification may only be issued by:
Wechsler Information Solution
The ACP framework is published to promote transparency and improve cybersecurity practices.
Organizations may use the framework for:
- internal cybersecurity assessments
- cybersecurity improvement initiatives
- educational purposes
However, organizations or individuals may not issue ACP certifications or represent themselves as an official ACP certification authority.
Only assessments performed under the authority of Wechsler Information Solution may result in official Active Cyber Program Certification.
See:
docs/governance.md
Organizations can apply the Active Cyber Program (ACP) independently to evaluate their cybersecurity posture. Getting started with ACP is simple.
The easiest way to start is the free web app at acp.videotrainer.ch (in German):
- no registration, no cookies, no data storage: all entries remain in your browser
- all ACP controls with guiding questions and scoring guidance
- immediate result: overall score, maturity level, domain scores, knock-out controls and improvement areas
The result is a self-assessment without review of evidence and not an ACP Certification. The source code is public: github.com/tomwechsler/acp-app.
The self-assessment guide explains step by step how to:
• define the assessment scope
• evaluate cybersecurity controls
• collect evidence
• calculate scores
• identify improvement areas
See:
docs/self-assessment-guide.md
The ACP framework consists of several core components.
The ACP principles describe the philosophy behind the framework and emphasize active cybersecurity management.
framework/acp-principles.md
The framework defines eleven cybersecurity control domains covering governance, operational processes and technical security controls.
framework/control-domains.md
The ACP maturity model evaluates how effectively cybersecurity practices are implemented.
framework/maturity-levels.md
All ACP controls are mapped to NIS2, ISO/IEC 27001:2022, the NIST Cybersecurity Framework 2.0 and, for AI security, the NIST AI Risk Management Framework. The mapping also lists topics that ACP does not cover, provides an overview of the NIST CSF 2.0 categories addressed by ACP and includes a note on the Swiss ICT minimum standard.
framework/control-mapping.md
The ACP framework includes a structured assessment methodology to evaluate cybersecurity programs.
Assessment process:
docs/assessment-process.md
Assessment tools:
assessment/assessment-checklist.mdAssessment Checklistassessment/evidence-requirements.mdEvidence Requirementsassessment/scoring-model.mdScoring Modelassessment/assessment-questionnaire.mdAssessment Questionnaire (PDF: templates/acp-assessment-questionnaire.pdf)- German questionnaire: assessment/assessment-questionnaire.de.md (PDF: templates/acp-assessment-questionnaire-de.pdf)
The ACP certification program defines how organizations are evaluated and certified.
Certification rules:
docs/certification.md
Trust label usage:
docs/trust-label.md
The ACP framework is maintained and governed by Wechsler Information Solution.
Governance documentation:
docs/governance.md
The ACP framework is designed for organizations of all sizes, including:
- small and medium-sized enterprises (SMEs)
- technology companies
- service providers
- public sector organizations
- suppliers in security-sensitive industries
The framework is designed to be practical, scalable, and applicable across industries.
active-cyber-program/
README.md
README.de.md
VERSION
CHANGELOG.md
SECURITY.md
LICENSE
docs/
overview.md
methodology.md
assessment-process.md
self-assessment-guide.md
certification.md
certification-process.md
trust-label.md
trademark.md
governance.md
author.md
framework/
acp-principles.md
control-domains.md
maturity-levels.md
control-mapping.md
assessment/
assessment-checklist.md
evidence-requirements.md
scoring-model.md
assessment-questionnaire.md
assessment-questionnaire.de.md
templates/
assessment-report-template.md
certification-template.md
improvement-plan-template.md
acp-assessment-questionnaire.pdf
acp-assessment-questionnaire-de.pdf
examples/
example-assessment.md
example-certification.md
certifications/
registry.md
legal/
acp-assessment-agreement-template.md
assets/
acp-logo.png
acp-framework-diagram.svg
acp-trust-label.svg
tools/
build-questionnaire-pdf.py
check-translations.py
Wechsler Information Solution, Tom Wechsler, Switzerland
Hofackerstrasse 8, 4625 Oberbuchsiten, Switzerland
Serving organizations in Germany • Switzerland • Austria
Framework author: Tom Wechsler
Contact: training@videotrainer.ch
See: docs/author.md
The Active Cyber Program (ACP) was created to provide a practical and transparent way to evaluate whether organizations operate an active cybersecurity program.
Cybersecurity evolves continuously.
The ACP framework will therefore evolve based on:
- emerging cyber threats
- assessment experience
- improvements in security practices
- feedback from organizations
New framework versions may be published periodically.
The ACP framework documentation is licensed under the Creative Commons Attribution-NoDerivatives 4.0 International License (CC BY-ND 4.0).
- You may share the unmodified framework for any purpose with attribution.
- Organizations and assessors may fill in, extend and share the templates, the assessment questionnaire and the checklist for their own assessments (additional permission, see
LICENSE). - Modified versions of the framework itself must not be distributed.
The names "Active Cyber Program" and "ACP", the ACP logo, the ACP Certification and the ACP Trust Label are not covered by this license. Their use is governed by the trademark and certification usage policy.
See LICENSE.