Security Assessment
Security Posture Review
A structured gap assessment of your controls, policies and processes against CIS Controls, NIST CSF or ISO 27001.
- Gap assessment against CIS Controls v8, NIST CSF or ISO 27001
- Policy and procedure documentation review
- Identity, access and privilege governance review
Where you stand against a recognised framework
Overview
Technical testing tells you what is broken today. A posture review tells you why it broke and whether it will happen again — because most recurring security failures are process failures, not technology failures.
We assess your people, process and technology controls against a recognised framework, score current maturity, and produce a phased improvement roadmap with realistic timelines and effort estimates.
A security posture review is a security posture assessment of your controls against a recognised framework. It works as an IT security audit or cybersecurity audit: a security controls assessment that compares what is in place with a sensible security baseline, and a risk assessment that ranks the gaps. The result is a cyber risk assessment you can share with leadership, with security consulting and cybersecurity consulting available to fix what it finds.
What is included
Everything in the engagement, in writing.
- Gap assessment against CIS Controls v8, NIST CSF or ISO 27001
- Policy and procedure documentation review
- Identity, access and privilege governance review
- Incident response readiness assessment
- Third-party and supply-chain risk review
- Scored maturity model with phased roadmap
What you get out of it
Outcomes you can hold us to.
- 01Objective maturity score to track year over year
- 02A roadmap that sequences work sensibly
- 03Framework alignment for certification or client due diligence
FAQ
Frequently asked questions
Which framework should we choose?
CIS Controls is the most practical starting point for small and mid-sized organisations. NIST CSF suits businesses reporting risk to a board. ISO 27001 is the right target if certification is a commercial requirement.
Does this get us certified?
A review is preparation, not certification — certification requires an accredited external auditor. We prepare you so that audit is a formality rather than a discovery exercise.
Is there an IT security checklist we can use before the review?
Yes. A short IT security checklist covers MFA on every account, supported and patched systems, endpoint protection, tested backups, admin access limited to named people and a written incident plan. A fuller IT risk assessment uses a cybersecurity risk assessment checklist that adds asset inventory, supplier risk, data classification and logging. The review covers both.
Ready to move on Security Posture Review?
We will scope it against your actual environment, not a generic package, and give you a fixed price before any work starts.