When this service helps
You need a detailed analysis of your practices and can make the required people and evidence available.
You need to establish a security roadmap and track progress.
A customer requirement or an insurance renewal calls for a more in-depth assessment.
What you receive
Deliverables
- Full report, scores by function and visual overview.
- Executive summary of 1 to 2 pages.
- Prioritized action plan.
- Results presentation during a session.
Scope covered
- Entities, sites and systems selected before data collection.
- Analysis of practices and evidence against the six functions of the NIST CSF 2.0, a cyber risk management framework.
- Internal score from 0 to 5, with justification of gaps and of the limits of the evidence.
How it works
- 01
Define the coverage
We specify the entities, systems and evidence to review.
- 02
Assess
We conduct the interviews and link the answers to the evidence.
- 03
Build the plan
We explain the internal scores and prioritize the improvements.
- 04
Validate and present
We validate the facts and present the roadmap to leadership.
Your involvement
Leadership and your IT manager or provider, with access to the agreed documents.
Service limits
- Scanning, penetration testing and technical configuration excluded.
- This assessment is not a certification audit.
The scope, responsibilities, recipients of the deliverables and confidentiality terms are agreed before data collection. Any change in scope is accepted in writing.
Frequently asked questions
When you need to analyze several practices in detail, gather their evidence and obtain a maturity measurement to organize improvements. The audit is suited to a first leadership-level review.
An internal scale from 0 to 5 organizes the results according to the six functions of the NIST CSF 2.0. Questions that do not apply are justified and excluded from the calculation. The limits of the evidence are explained with the results.
No. It is an assessment of your practices within the agreed scope, with an internal score and recommendations.
The documents and evidence agreed at the start, with help from leadership and your IT manager or provider. Access remains limited to what is authorized.
No. The engagement produces the analysis and the roadmap. Changes to your systems are made by your teams or under a separate service.