What we deliver
We run a comprehensive assessment of the organization's security posture, covering people, processes and technology. Depending on the context, the assessment can rely on references such as the CIS Controls, the NIST Cybersecurity Framework and the ISO 27001 standard on information security management. We deliver a clear picture of the current state, the gaps found and a roadmap prioritized by risk and effort, which makes investment and audits more predictable.
The problem it solves
Organizations without clear visibility into their security maturity, that need to prioritize investments or that are preparing for audits.
CISOs, CTOs and IT managers who need an independent, structured view of the organization's security posture.
At the start of a security program, before external audits, after incidents or when the organization needs to prioritize security investments.
Scope of work
Deliverables
How the work happens, in practice
What the assessment is made of
It combines documents, interviews and sampled technical verification. People, processes and technology are assessed together, because many incidents stem from process gaps rather than a lack of tools. Examples of what is examined: periodic access review and user offboarding, change management, asset inventory, vulnerability and patch management, backup and restore, awareness, incident response plan and vendor management. In the technical verification, samples of servers, accounts and configurations show whether what the policy says is what actually happens.
References used
The CIS Controls (version 8) offer a prioritized list of technical actions, organized into implementation groups for organizations of different sizes and maturity levels; the NIST Cybersecurity Framework (version 2.0) organizes risk management into govern, identify, protect, detect, respond and recover; ISO/IEC 27001:2022 defines the requirements of the information security management system, with reference controls in Annex A. None of them is mandatory by itself: the choice depends on the industry, customer requirements and what the business needs to demonstrate, and the three can be mapped to one another.
What to do with the result
A good assessment ends in decisions: what to fix first, what depends on investment and what can wait. Gaps are ordered by risk (likelihood and impact) and by effort, so that simple, high-effect fixes, such as enabling MFA or closing an exposed service, come before long projects. The executive reading is separated from the technical detail, with evidence for each finding, so that leadership and the security team work from the same roadmap. Repeating the assessment later makes it possible to compare progress against the starting point.
What sets us apart
- A practical view, not just a paper exercise
- Prioritization that takes the context of the operation into account
- Deliverables ready to present to leadership and to use as audit evidence
Methodology
Document collection and interviews
Workshops with technical teams
Quantitative assessment by domain
Action plan with owners
Presentation of results
Highlights
Frequently asked questions
The self-assessment shows, in about 7 minutes, how the organization believes it is doing. The technical assessment shows what the evidence demonstrates.
Start with the free cybersecurity maturity self-assessmentReady to move forward?
Tell us about your context and challenges. We reply with a clear proposal.