The article
Someone has asked you a question you cannot answer with a number. It comes from a prospect's security questionnaire, a cyber insurance renewal or a board member who wants to know how secure the company really is. Cyber security assessment consulting turns that question into two things you can act on: a score against a recognized framework and a ranked list of gaps, with what each would take to close.
I have been building software for 18 years, and since 2017 my team of 70+ specialists has delivered 150+ projects; clients rate us 5.0 on Clutch from 26 verified reviews (as of September 2026), none of them negative. We assess security the way people who build systems do: we read your policies, and we also open the systems, the cloud and the code, because many gaps sit there, not in the documents.
Cyber security assessment consulting: the short version
| What | How it works |
|---|---|
| The question it answers | Where your security stands today, and what to fix first |
| Measured against | NIST CSF, ISO 27001, CIS Controls or the framework your clients or regulators expect |
| What we review | Policies and ownership; accounts and sign-in; networks, devices and the cloud; applications and their code; backups and the incident plan |
| What you get | A score against the framework and the gaps ranked by risk, each with its fix, effort and cost |
| Tests | Scans and tests of your systems, when you want proof beyond documents |
| Price | The first call and the rough estimate are free; the assessment is estimated before it starts |
Assessment, audit, risk assessment or test: which one you need
An assessment helps you improve; an audit checks you against a standard for someone else. People mix both up with risk assessments and penetration tests, and each of the four answers a different question. All four are among our IT security services. Forward this table to whoever asked for "a security review":
| You need to... | Choose | What you get |
|---|---|---|
| Know where you stand and what to fix first | An assessment | A score against a framework and a ranked list of gaps |
| Prove your controls to a client, an auditor or a certification body | An audit, and help getting ready for it | Findings with evidence; a certificate or an attestation comes from an independent auditor |
| Decide where a limited budget lowers risk the most | A risk assessment | Each risk rated by likelihood and cost, and a plan in order of importance |
| Find out whether an attacker could get in | A penetration test | The holes an attacker would use, with proof, and a retest after the fixes |
Many companies do an assessment first to pass an audit later. If you are not sure which one you need, start with the assessment: it shows which of the others are worth paying for, and when.
Which framework to assess against
Use the framework your clients or regulators already expect; if nobody expects one yet, pick the one that fits your size. Three cover most cases:
| Framework | Published by | What it ends in | Fits |
|---|---|---|---|
| NIST CSF 2.0 | NIST, the US standards institute, in February 2024 | A current profile, a target profile and the plan between them | Any company that wants one picture for its board and clients |
| ISO 27001 | ISO and IEC | A certificate from an accredited certification body, after a separate audit | Companies whose clients ask for the certificate |
| CIS Controls | The Center for Internet Security | A list of safeguards in place and missing | Small teams with no security program yet |
NIST CSF 2.0 sorts security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It also gives the score its words: NIST describes practices as Partial, Risk Informed, Repeatable or Adaptive, tiers 1 to 4. For a small company, CIS offers a practical yardstick: its first implementation group, 56 safeguards that CIS calls essential cyber hygiene. If an ISO 27001 certificate is the goal, assess against it from the start; ISO 27001 consulting takes it from there.
In October 2026 I read the three company pages from Google's first page for this search that my script could measure. None mentions the CIS Controls, and none publishes a price. Three pages are a small sample, but the framework with a starter set for small teams did not come up once.
Cybersecurity assessment consulting, area by area
Cybersecurity assessment consulting covers five areas, and each has a classic gap:
| Area | What we look at | A typical gap |
|---|---|---|
| Policies, and who owns security | Written rules, who approves them, who answers for each system | A policy exists; nobody owns it |
| Accounts, access and sign-in | Two-factor sign-in, admin rights, shared accounts, people who left | A former employee still has an active account |
| Networks, devices and the cloud | What is open to the internet, laptops and phones, cloud settings | A database or an admin panel reachable from anywhere |
| Applications and their code | Libraries, checks on input and payments, keys in the code | An app that trusts a message without checking who sent it |
| Backups and the plan for an incident | Copies, restores, who does what on a bad day | A backup nobody has ever restored |
The fourth row is where a document review stops and engineering starts. In the booking site we built for Somatic Reset, a payment is trusted only after a signed webhook and a fresh read from Stripe, so a message that merely says "paid" books nothing. An assessment of any app that takes money asks the same question, and only someone who reads code can answer it.
What you get: a score and a list
You get where you stand against the framework, and the gaps ranked by risk, with the fixes, their effort and their cost: short enough to act on. Here is how findings read (an illustration, not a client's data):
| Gap | Risk | Fix | Effort |
|---|---|---|---|
| Two people who left still have cloud accounts | High | Remove them; tie sign-in to the company directory | Small |
| Backups run, but no restore has ever been tested | High | Restore one copy and time it; repeat every quarter | Small |
| Nobody owns security decisions | Medium | Name one person and a deputy, and write down what they decide | Small |
A pile of pages makes a company feel busy; a short ranked list gets it fixed. You decide who fixes what: your team, another firm or our engineers through cybersecurity remediation, where every fix is checked again.
Do you test the systems too?
Yes, when you want proof beyond documents: scans and tests of your systems sharpen the findings. A policy can say that every admin page needs two-factor sign-in; only a test shows whether one of them answers anyone who finds it. What we test, how deep and when is agreed in writing first, and a full attack simulation is its own service, penetration testing.
How it goes
- A free first call. What you run, who asked for the assessment and why. If you need an NDA, we sign it before you share details.
- Scope in writing: the framework, the systems, the offices and the clouds.
- Interviews with the people who run IT, development and the business.
- The review: documents first, then the systems, the cloud and the code; scans and tests if agreed.
- The report and a call to walk through it, then a roadmap: what to fix first, next and later, with owners and costs.
- A second look later. Run the same assessment after the main fixes, and the two scores show the progress.
Every access you give us goes on a list, so when the work ends you know exactly what to revoke.
What the assessment costs
Every assessment is estimated before work starts, and the first call and the rough estimate are free. The price depends on:
- the number of people, offices, clouds and applications in scope;
- the framework, and whether a certificate is the goal;
- whether you want scans and tests on top of interviews and documents;
- how much is written down already.
The assessment sits at the start of cybersecurity consulting. With an audit date set, go on to audit consulting; to put the risks in money, risk consulting; if your biggest unknown is the cloud, cloud and cybersecurity consulting. If you were breached last week, skip all of this and call incident response.
Ask for an assessment: we reply with the scope we would suggest and a rough estimate, free.
