Security Posture Assessment
A gap analysis against CIS Controls with a prioritized roadmap.
Who it’s for
- Cyber insurance renewal is asking questions you cannot answer confidently
- You have never had an outside set of eyes on the environment
- Leadership wants a security budget grounded in findings, not fear
What you get
- CIS Controls gap analysis
- Risk-ranked findings
- 90-day and 12-month roadmap
- Executive summary
The deliverable is yours whether or not you hire us for what follows.
What we need from you
- Read-only access to key systems
- Interviews with IT and one business leader
- Existing policies, if any
What we check
- Asset inventory
- Software inventory
- Data protection
- Secure configuration
- Account and access management
- Vulnerability management
- Audit logging
- Email and browser protections
- Malware defenses
- Data recovery
- Security awareness
- Incident response readiness
How it works
- 0115-minute scope callConfirm the assessment fits your situation and agree the fixed fee. If it does not fit, we say so and nobody has spent anything.
- 02Access and kickoffRead-only access, an export, or a short interview, depending on the assessment. We list exactly what we need before you commit.
- 03The workOne to three weeks depending on the assessment, with a mid-point check-in so nothing lands as a surprise.
- 04Written deliverable and walkthroughA document your team keeps, presented live with time for questions. What happens next is your call.
Common questions
Is this a penetration test?
No, and we say that plainly. This is a posture assessment: configuration, identity, surface, and readiness, mapped to the CIS Controls. A pentest attempts exploitation and is a different engagement.
Will it disrupt our users or systems?
No. The work is read-only review and passive external observation. Nothing is exploited, stress-tested, or changed.
Our IT team is nervous about being graded. Should they be?
The report is written to make your team stronger, not to assign blame. Most gaps are resourcing decisions, not competence failures, and the roadmap is theirs to execute.
Part of Microsoft 365, Identity & Security Hardening.
Book a 15‑minute scope call.
You describe the problem. We tell you what fixing it takes, what it costs, and whether we are the right firm for it.