01
Scope
Agree the standard and the boundary — which business units, environments, and CIS Implementation Group are in scope — so the assessment fits your risk, not a generic checklist.
Governance & Gap Assessment
Know How Mature Your Security Program Is — and What to Fix First
We measure your security program against the CIS Controls, score where you stand today, and hand you a board-ready roadmap to close the gaps that carry the most risk — in business terms, not a scanner dump.
Why It Matters
A clear read on where your program stands
A gap assessment answers the questions leadership actually asks: how mature is our security program, how do we compare to a recognized standard, and where should the next dollar go? It turns a sprawling security picture into a scored, defensible view you can take to a board, an auditor, or an insurer.
We measure against the CIS Controls — a widely adopted, prioritized baseline — scoped to the Implementation Group that fits your size and risk. You get a current-state maturity score, the specific gaps to your target, and a sequenced plan to close them.
Measured against a standard, not an opinion. Scoring your program against the CIS Controls means the result is comparable year over year, explainable to non-technical stakeholders, and useful as evidence when a customer or cyber insurer asks how you manage risk.
The Framework
How a gap assessment works
Five steps, from scope to a roadmap your team can execute and your board can follow.
02
Assess
Gather evidence: interviews, document and policy review, and control walkthroughs. We map what actually exists today to each CIS Safeguard — not what the diagram claims.
03
Score maturity
Rate each domain's current maturity against the standard, producing a defensible baseline you can compare against next year and explain to non-technical stakeholders.
04
Gap analysis
Set the target maturity and measure the distance to it, domain by domain. The gaps are ranked by the risk they carry, so the biggest exposures surface first.
05
Roadmap & governance
A sequenced remediation plan — what to fix, in what order, and roughly what it takes — plus a governance cadence to keep the program improving after we leave.
→
The result
A maturity picture your board understands and your team can act on — the same current-vs-target view shown in the radar above, backed by a prioritized roadmap.
Assessment Services
Governance and program assessments
01
CIS Controls Gap Assessment
Your security practices scored against the CIS Controls and Safeguards, aligned to the Implementation Group appropriate for your size and risk, with a practical path to the next level of maturity.
- Safeguard-level current-state review
- Implementation Group alignment
- Maturity scoring by domain
- Gap register, ranked by risk
- Sequenced remediation roadmap
- Evidence for customer and insurer questionnaires
02
Security Program Assessment
A broader view of the whole program: what is in place, what is missing, what is working, and where investment produces the most risk reduction — framed for the people who set budget and priorities.
- Governance and risk management
- Identity and access
- Vulnerability and patch management
- Security operations and monitoring
- Incident response and recovery
- Third-party and vendor risk
- Security awareness
- Policy and program maturity
03
Security Architecture Review
A design-level review of how controls are layered to enforce the trust boundaries they are meant to — identity, network, cloud, and data protection — assessed as strategy, not a configuration audit.
- Identity and authentication architecture
- Network and segmentation design
- Cloud and hybrid architecture
- Data protection and key management
- Detection and logging coverage
Need the technical picture too? Hands-on validation — vulnerability assessments, network and firewall review, and demonstrated attack paths — lives on the tactical side. See Penetration Testing & technical assessments.
Deliverables
What you receive
Board-ready output that a leadership team can act on without needing a translator, backed by the detail your practitioners need.
- An executive summary framing maturity and risk in business terms
- A maturity radar — current state against your target
- A gap register, ranked by the risk each gap carries
- A sequenced, costed remediation roadmap
- A governance cadence to keep the program improving
- Evidence you can hand to customers and cyber insurers
- A debrief session with your leadership and technical teams
Discuss a gap assessment
Whether it is a full CIS Controls gap assessment, a program-level review, or evidence for an insurer or customer, we will scope it to your size and risk.