Information Security Risk Assessment

Our Information Security Assessment enables stakeholders to speak the same language in order to effectively prioritize the mitigation of the most urgent, realistic and expensive of potential information security threats.

Providing a comprehensive information security risk assessment.

C’S|3 offers a comprehensive information security risk assessment designed to discover and quantify information security risk. An industry standard used by security practitioners around the country, our methodology helps inform effective information security programs and allows organizations to prioritize and maximize information security investments. Quantification of risk also provides the common language for security practitioners and executives to speak about risk. This allows organizations to understand their current standing, where they want to be, and how to get there.

We map the requirements to many different standards including HITRUST, ISO 27000-1, NIST CSF, FFIEC, NCUA, GLBA, and FISMA.

Start A Conversation

Information Security Risk Assessment Includes

This assessment consists of a thorough evaluation of risks within four phases: Administrative Controls, Physical Controls, Internal Technical Controls, and External Technical Controls:

ADMINISTRATIVE CONTROLS

Sometimes referred to as the “human” part of information security and are controls used to govern other parts of information security.

PHYSICAL CONTROLS

The security controls that can often be touched and provide physical security to protect your information assets.

INTERNAL TECHNICAL CONTROLS

The controls that are technical in nature and used within your organization’s technical domain (inside the gateways or firewalls).

EXTERNAL TECHNICAL CONTROLS

These are technical in nature and are used to protect outside access to your organization/s technical domain (outside the gateways or firewalls).