1. A method for determining a cyber-security risk profile key, comprising: determining by an automated processing device tool agent key performance indicator values from values assigned to answers to each of a plurality of questions presented to personnel in an organization implementing a control system, wherein the answers are chosen from a group of two or more possible answers presented to the personnel with each of the questions, and each of the answers for any question is assigned a different point value, and wherein the questions are each relevant to and belong to one of plurality of a subset category areas of an overall, procedures and protocol domain area of cyber-security; combining by the automated processing device tool the key performance indicator values of the individual questions in each subset category area into composite key performance indicator values for each of the subset category areas; combining by the automated processing device tool the subcategory key performance indicator values into a composite procedures and protocol key performance indicator value for the automated system; collecting by the automated processing device tool group security policy data with respect to all of plurality of individual computers in the system, wherein the collected security policy data comprises system-wide policy information and system settings of the automation system; processing by the automated processing device tool the collected security policy data to determine and select a predefined security policy statement for each of a plurality of different security policy attributes of the automation system as a function of compliance of the collected security policy data with a specific set of recommended security policy settings compatible with each of the individual computers in the system, wherein each selected security policy statement is chosen from a group of two or more possible statements determinable by the automated agent for each of the different security policy attributes, and wherein each of the statements that is possibly assigned for any one of the security policy attributes is assigned a different point value; determining via the automated processing device tool key performance indicator values for each of the security policy attributes from the values assigned to the selected statements for the security policy attributes; combining by the automated processing device tool the security policy attribute key performance indicator values into a composite security policy key performance indicator value for the automated system; and generating by the automated processing device tool a cyber security risk diagram that displays a level of cyber security risk represented by the composite readiness key performance indicator value relative to a level of cyber security risk represented by the composite security policy key performance indicator value.