Information Security Risk Assessment
Security arguments stall when the security team and the executive team are describing the same risk in two different languages. We discover and quantify your information security risk, so everyone can prioritize against the same numbers.
Prioritize the expensive threats, not the loudest ones
Our assessment enables stakeholders to speak the same language, so you can effectively prioritize mitigation of the most urgent, realistic, and expensive of your potential information security threats.
The methodology is an industry standard used by security practitioners across the country. It helps inform an effective information security programme and lets you maximize what you get for the money you spend on it.
Quantifying risk is what makes that possible. It gives practitioners and executives a common language, so the organization can see where it stands today, where it wants to be, and what it will take to get there.
Frameworks we map to
One assessment, mapped across the standards your regulators, customers, or board are likely to invoke.
- HITRUST
- ISO 27000-1
- NIST CSF
- FFIEC
- NCUA
- GLBA
- FISMA
- SOC 2
- HIPAA
Four phases of control, evaluated thoroughly
Risk lives in all four. An assessment that only reaches the technical ones will miss the failures that actually happen.
Administrative controls
Sometimes called the “human” part of information security — the controls used to govern every other part of it.
Physical controls
The controls you can often literally touch, providing physical security for your information assets.
Internal technical controls
Technical controls operating inside your organization’s own domain — within the gateways and firewalls.
External technical controls
Everything facing outward from that boundary — where most of the attempts come from.
When the stakes were people, not data
A global organization needed staff in some regions to operate without publicly associating with it — the personal safety of those employees depended on it. For years, U.S. staff had been coordinating with them over public email accounts, VPNs, and public cloud storage.
We replaced that with real centralized identity management behind a generically branded portal, adding second-factor authentication with both hardware and software tokens, because some staff work in areas with no phone coverage.
What you get
- Risk discovered and quantified, not just listed
- All four control phases evaluated
- Findings mapped to the frameworks that apply to you
- A prioritized roadmap you can budget against
- Language that works for both the board and the security team
Find out where you stand
Tell us what you’re protecting and who’s asking about it. In 30 minutes we’ll give you an honest read on the gap and what closing it involves.
- A straight answer on scope and timeline, not a sales pitch
- No charge, and no obligation to engage us
- You talk to a senior consultant, not an account rep
- Prefer to talk now? 719-204-3101