Know where you stand, and what to fix first.
For organizations whose customers, insurers, or leadership are asking about security. We measure your program against the NIST Cybersecurity Framework and hand you a plan.
Five deliverables.
Gap assessment
Your people, processes, and technology reviewed against the six functions of NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, and Recover.
Ranked gap register
Every gap scored by risk and by effort, so the quick wins and the serious exposures are obvious.
90-day roadmap
Actions in three 30-day sprints with owners and quick wins first, so your team knows what to do on Monday.
Executive summary
A short, plain-language report you can share with leadership, a customer, or your insurer.
Two-hour strategy session
Findings, priorities, and budget, worked through with your leadership team.
From kickoff to roadmap.
Discover
Kickoff call, document request, and interviews with the people who run your systems.
Assess
We measure your environment against the framework and score every gap.
Build
Gap register, roadmap, and summary drafted and quality-reviewed.
Deliver
The strategy session, where we hand everything over and set your priorities.
A clear starting point, not a certificate.
A gap assessment tells you honestly where you stand and what to do next. It is not an audit or a certification, and we never tell you that you are compliant on our say-so. What you will have is a clear gap list and a plan, which is exactly what customers and insurers look for first.
Will we be "compliant" when we finish?
No. You will know exactly where you stand and have a plan to close the gaps. Closing them is the work that follows, and we can help with that as a separate engagement.
How much of our time does it take?
Mostly the kickoff, a few interviews with the people who run your systems, a document request, and the final strategy session. We do the writing.
Do you change our systems?
No. The gap assessment is advisory. We recommend; your team or IT provider makes changes. Hands-on help is available as a separate engagement.
We have CMMC in our contract. Does this cover it?
A gap assessment against the NIST Cybersecurity Framework is a general starting point. If your contract includes CMMC, CMMC Readiness measures you against the exact requirements for your level.
What does it cost?
The gap assessment is a fixed price, quoted after a short call about your size and scope. You know the cost before we start.
Ready to find out where you stand?
A short call tells us your size and scope. You get a fixed quote before anything starts.