Cyber security assessment that gives you a board-ready answer in 14 days

The Quick Risk Snapshot is 5 business days end-to-end, including kickoff, evidence collection, scanning, scoring and a 60-minute readout. The full CIS v8 or NIST CSF 2.0 assessment runs 4 weeks: week 1 kickoff and document review, week 2 technical scanning and interviews, week 3 control-by-control scoring and gap analysis, week 4 remediation runbook and executive readout.

Five artifacts: (1) Executive summary slide deck written for non-technical board members, (2) control-by-control gap analysis spreadsheet mapped to your chosen framework, (3) technical findings report with severity, exploitability and asset context, (4) prioritized remediation runbook sequenced by risk-reduction-per-dollar, (5) evidence packet ready for cyber insurance renewal or auditor review. All five are delivered as both PDF and source format (PPTX, XLSX, DOCX) so you can edit and re-use internally.

Five roles, total time commitment ~6 hours across 4 weeks for the full assessment: IT lead (kickoff + 3 technical interviews, ~3 hours total), HR lead (1 interview on identity, onboarding, offboarding, ~45 min), finance lead (1 interview on vendor risk and approvals, ~45 min), operations lead (1 interview on physical security and BCP, ~30 min), and an executive sponsor (kickoff + readout, ~1 hour). For a Quick Snapshot, IT lead alone is enough: ~2 hours across 5 days.

No assessment finds everything. We're explicit about this in the deliverable. The full CIS v8 IG2 assessment combines: external attack-surface scanning (Shodan-class enumeration, exposed services, expired certs, DNS hygiene), authenticated configuration review of identity, endpoint and cloud, document review of policy and process, and structured interviews. We do not perform exploitation or social engineering unless you specifically engage us for a penetration test: that's a separate scope. The assessment finds the controls gaps that lead to incidents; a pen test demonstrates exploitability of specific paths.

Yes. We map every finding to the standard insurance questionnaire taxonomy used by Coalition, At-Bay, Chubb, Travelers, AIG, CNA and Beazley: MFA coverage, EDR coverage, backup posture, privileged access, email filtering, awareness training, vendor management. The evidence packet is what your broker needs to negotiate premium and remove exclusions.

CIS Controls v8 (Implementation Group 1 or 2), NIST Cybersecurity Framework 2.0, ISO/IEC 27001:2022, SOC 2 Trust Services Criteria, HIPAA Security Rule (45 CFR 164.308-318), PCI-DSS 4.0, NYDFS 23 NYCRR 500 (for licensed financial entities in New York), and FTC Safeguards Rule (for non-banking financial institutions). We can also run a custom framework mapping if you're certifying against a customer-specific control set (Microsoft SSPA, AWS WAF, Salesforce ISVForce).

You decide. Some clients run remediation entirely in-house using our prioritized runbook as the work-plan. Some retain us for the highest-impact items only (typically MFA enforcement, EDR rollout, backup hardening, privileged access cleanup). Some move into our Continuous Risk Program for ongoing managed remediation with monthly attestation. There is no requirement to engage us for remediation: the assessment deliverable is yours regardless. We will tell you honestly which findings are best handled by your existing MSP or in-house team versus where outside specialist help moves faster.

It means the assessment surfaces the issues a pen test would find: before you pay $25-50K for a pen test that comes back full of low-effort findings. We do this by running authenticated configuration review against the same control families a pen tester probes: identity (MFA, privileged accounts, service accounts), endpoint (EDR coverage, patch latency, local admin sprawl), network (segmentation, lateral movement risk, exposed services), and data (sensitive data location, encryption at rest). After remediation, the pen test that follows finds harder, higher-value issues: not the obvious ones.

Yes. Mutual NDA signed before any documents are exchanged. For HIPAA-covered entities or business associates, we sign a Business Associate Agreement (BAA) before any PHI-adjacent system is touched. Standard Master Services Agreement covers liability, IP ownership of deliverables (you own them), data handling, and post-engagement data destruction. All three documents are reviewed and returned.

Three options: (1) take the deliverables and run remediation in-house: we offer a free 30-day Q&A window for clarifying questions, (2) engage us for prioritized remediation projects on a fixed-fee basis: typically MFA rollout, EDR deployment, backup hardening, identity cleanup, (3) move into the Continuous Risk Program for monthly attestation, quarterly re-assessment, and audit-ready evidence collection.