Security assessment

Baseline security assessment

We walk your security program against 54 tiered requirements, mark each one met, partial, or missing, and name the artifact that would prove it.

What we cover

The assessment follows our public security program baseline, organized into tiers so the depth matches where your company actually is.

• Tier 1, Baseline: the controls any company should have. Absence is a finding.
• Tier 2, Standard: what you add once customers depend on you or you hold sensitive data.
• Tier 3, Advanced: an operated program with a security function or MSSP behind it.
• AI (if using AI): the newer questions, such as where sensitive data goes when staff use AI tools.

We loosely follow the CIS Critical Security Controls v8.1, with NIST CSF Govern for the board framing.

What you get

• A control-by-control review, each requirement marked met, partial, or missing
• The specific artifact that proves each control, so you can show an auditor or a customer
• A prioritized gap list, worst first
• A board-ready summary, including the questions a board should be asking

Scope

Each engagement is scoped to the company. The baseline above is the typical shape, and the depth depends on your size, your obligations, and your budget. It often comes before other work, such as CMMC, SOC 2, ISO, or a fractional CISO retainer, because it shows what needs doing first.

The questions are public. The self-assessment has the same ones if you want to look first. If it would help to talk through scope, get in touch.