When this service helps
You lead an SMB and lack visibility into your cyber risks.
You want a first assessment before a more in-depth project.
You need to choose, with your IT team, which priorities to fund.
What you receive
Deliverables
- Summary of the main risks identified and of the missing information.
- Initial assessment report with the observations and their limits.
- First actions ranked by priority and topics to explore further.
Scope covered
- Leadership interview and review of the available documents.
- Overview of practices: access, backups, suppliers, continuity, awareness and how the response is organized.
- Topics that require a more in-depth review are identified in the report.
How it works
- 01
Frame
We confirm your objectives, the people involved and the useful information.
- 02
Discuss
We conduct the interview and document the evidence available.
- 03
Prioritize
We separate the findings, the limits and the first actions proposed.
- 04
Present
We present the results and address your comments.
Your involvement
An executive and a contact person who knows your organization’s IT practices.
Service limits
- Scanning, penetration testing and configuration review excluded.
- Technical fixes and support after the report under a separate engagement.
The scope, responsibilities, recipients of the deliverables and confidentiality terms are agreed before data collection. Any change in scope is accepted in writing.
Frequently asked questions
The audit is a first leadership-level assessment: an interview, a review of the available information and the priorities to address. The maturity assessment examines practices and their evidence in greater depth, with a score for each function.
An executive and someone who knows your IT practices, either in-house or at your provider. They help clarify the useful information and validate the facts.
No. The audit relies on discussions and the available documents. A scan or technical review requires a separate engagement.
It sets out the main risks identified, the missing information and the proposed actions. On its own, it does not confirm the technical effectiveness of your protections.
No. You can use the recommendations with your team or your current provider.