Consulting
Sometimes what you need is not another tool. It is a clear picture.
Assessments with a written report, NIST CSF 2.0 posture scoring, cyber insurance and compliance questionnaire support, and a roadmap you can actually budget against.
A lot of security spending happens backwards. Something alarming appears in the news or a vendor gets in front of the owner, a product is purchased, and it sits in the environment without anyone being able to say what risk it reduced or whether a cheaper control would have done more.
An assessment reverses that order. It establishes where you actually stand, scores it against a recognized framework so the result is comparable rather than an opinion, and produces a prioritized list. Some items on that list cost money. A surprising number cost an afternoon.
We do assessments for clients and for businesses who are not clients and may never be. The report is yours either way. If it tells you that the most valuable thing you could do this quarter is turn on multi-factor authentication everywhere and write down who calls whom during an incident, that is a useful answer even though nobody sells it.
Talk through what you need →- Businesses holding a cyber insurance application or renewal and finding that they cannot answer it with confidence. The application is, in effect, a free gap assessment written by the people who pay when it goes wrong.
- Companies that have just been sent a security questionnaire by a customer and realized the answer determines whether they keep the account.
- Owners who inherited an environment, through acquisition, a departure, or a provider change, and want an independent picture before deciding anything.
- Organizations already spending on security who want to know whether the spending is aimed at the right things.
Scope
What we assess and deliver
Network and security assessment
Endpoints, servers, network design, backups, identity and access, remote access and exposure. What is running, what is exposed, what is unsupported, and who can reach it.
NIST CSF 2.0 posture scoring
Findings scored against the NIST Cybersecurity Framework 2.0 so the result is measurable and can be tracked over time rather than re-litigated every year.
A written, prioritized report
Plain language, ordered by what reduces the most risk per dollar, with the quick wins separated from the capital projects. Written to be read by an owner, not only by an engineer.
Cyber insurance application support
These applications are technical, and the answers become part of the contract. We help establish what the honest answer is for each control, document the qualifications, and close what can be closed before you sign.
Compliance and vendor questionnaire support
When a larger client sends a security questionnaire, or an obligation like HIPAA or PCI applies, we help map what is in place, what is missing and what evidence you can produce.
Technology roadmap and budget planning
What has to be replaced and when, what it will cost, and what can wait. Spread across quarters rather than arriving as a surprise.
Quarterly business reviews
A recurring look at what changed, what the current posture score is, what was closed and what is next. This is how a roadmap stays a plan instead of a document.
Process
How the assessment works
It costs nothing, it takes about an hour of your time, and you keep the report whether or not you hire us.
- 01
A conversation first
What the business does, what would hurt most if it stopped, what you are already worried about, and what obligations you carry. Risk is specific to a business, so the technical review has to be aimed.
- 02
The technical review
We look at the network, endpoints, servers, backups, accounts and access, and identify what is exposed, unsupported or unmonitored.
- 03
Scoring and prioritization
Findings are scored against NIST CSF 2.0 and ordered by risk reduced rather than by what is easiest to sell.
- 04
The report and the walkthrough
You get the written report and a session to go through it. Plenty of clients take the report and close the first several items themselves. That is a legitimate outcome.
Common questions
Consulting & Assessments
Is the assessment really free, and what is the catch?
It is free and you keep the report. We do it because the businesses that most need help usually do not know what they need, and a scored report is a better conversation than a sales pitch. If the report says your environment is in good shape, that is what it will say.
What is NIST CSF 2.0 and why score against it?
It is the National Institute of Standards and Technology Cybersecurity Framework, a widely recognized structure for organizing security practices. Scoring against a published framework means your result is comparable year over year and recognizable to insurers, auditors and clients, rather than one provider's opinion.
Will this disrupt our operations?
No. An assessment is a review, not a change. We are looking and documenting, not reconfiguring, and the hands-on portion is typically about an hour of someone's time.
Can you help us fill out a cyber insurance application?
We help you establish what the technically accurate answer is for each control, and document where the honest answer is partly rather than yes. We are not insurance brokers or attorneys, so the policy language and the legal consequences of a representation belong with your broker and your counsel.
Do we have to become a managed IT client afterwards?
No. Some assessment clients hire us, some hand the report to an existing provider, and some work through it themselves. The report is written to be useful in all three cases.
Related
Often paired with
Managed IT & Helpdesk
Helpdesk, patching, monitoring, backups, onboarding and offboarding for small and medium businesses across Central Kentucky. Not a break-fix number you call after something has already gone wrong.
Read more →Awareness Training
Continuous training and realistic phishing simulation that turns the person an attacker aims at into the person who reports the attempt.
Read more →Network & Servers
Firewalls, switching, wireless, VPN and the servers behind them, designed and maintained as one segmented, monitored, documented system.
Read more →Not sure where to start? Start with the assessment.
It is free, it takes about an hour of your time, and you walk away with a scored report either way.