Cybersecurity Risk Assessment

A threat-informed assessment of the cyber risks to your most important data and systems, rated in business terms.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Know which cyber risks could hurt the business most, and what to do first.

The challenge

Most or­ga­ni­za­tions can list their se­cu­ri­ty tools. Far fewer can say which cyber risks could do the most dam­age, how like­ly they are, and whether cur­rent con­trols bring them with­in an ac­cept­able level. Without that an­swer, se­cu­ri­ty bud­gets fol­low ven­dor pitch­es and the lat­est head­line in­stead of the risks that mat­ter.

How we help

We start with what you need to pro­tect: the data, sys­tems, and ser­vices the busi­ness can't run with­out. For each one, we look at the threats it re­al­is­ti­cal­ly faces, such as ran­somware, cre­den­tial theft, fraud, and ven­dor com­pro­mise, and at the weak­ness­es an at­tack­er could use.

Then we weigh the con­trols you al­ready have and rate the re­main­ing risk in busi­ness terms: what it could cost, what it could dis­rupt, and how it com­pares with the risk ap­petite your lead­ers have set. The re­sult is a ranked view of what to treat first, what to ac­cept, and who owns each de­ci­sion.

Because the as­sess­ment fol­lows rec­og­nized meth­ods, it also gives you ev­i­dence for reg­u­la­tors, cyber in­sur­ers, and cus­tomers who ask how you man­age cyber risk.

What you get

  • Critical asset, data, and service identification
  • Threat scenarios relevant to your industry and operations
  • Assessment of existing controls against each scenario
  • Risk ratings in business terms, measured against your risk appetite
  • A risk register with owners, treatment decisions, and timelines
  • An executive summary for leadership and the board

Standards we work with: NIST SP 800-30, NIST CSF 2.0, ISO/IEC 27005, and ISO 31000.

Good fit if your board or cyber in­sur­er has asked for a cyber risk as­sess­ment, or se­cu­ri­ty spend­ing keeps grow­ing with­out a clear view of the risks it ad­dress­es.

Questions clients ask

How is this different from a cybersecurity program assessment?

This assessment identifies and rates your cyber risks in business terms. A cybersecurity program assessment, part of our IT & Cybersecurity Audit Advisory work, tests how mature and effective your security controls are against a framework such as NIST CSF 2.0. Many clients start with one and follow with the other.

How often should we repeat it?

At least once a year, and again after a major change such as an acquisition, a new core system, or a significant incident.

More in Governance, Risk & Compliance

IT Risk Assessment

Identification and rating of the risks across your IT environment and critical business systems, measured against your risk appetite.

  • Risk identification across systems, processes, and IT operations
  • Likelihood and impact ratings tied to your risk appetite
  • A risk register with owners and treatment decisions
Learn more about IT Risk Assessment

Cloud Risk Assessment

An assessment of the risks in how you use the cloud, including provider dependence, data location, shared responsibility, and exit options.

  • Cloud service inventory and data classification
  • Provider, concentration, and exit risk
  • Shared responsibility gaps rated against your risk appetite
Learn more about Cloud Risk Assessment

GRC Program and Control Framework Design

One control library that links your risks, policies, controls, and obligations, so risk, compliance, and audit work from the same list.

  • An integrated risk and control library
  • A compliance obligations register linked to tested controls
  • Risk appetite statements and board reporting
Learn more about GRC Program and Control Framework Design

Information Security Policy Writing

Information security policies and standards, written or rewritten to fit how you operate and mapped to the frameworks your customers expect.

  • A policy and standard set sized to your organization
  • Mapping to NIST, ISO/IEC 27001, and SOC 2 criteria
  • An owner and review cycle for each document
Learn more about Information Security Policy Writing

Remediation Management

Issue and remediation tracking with owners, dates, and escalation, plus validation that each fix addresses the original risk.

  • Issue intake and prioritization
  • Owners, deadlines, and escalation paths
  • Closure validation before issues are closed
Learn more about Remediation Management

Third-Party Risk Management

A vendor risk program that tiers vendors by criticality and data access, so due diligence goes where the risk is.

  • Vendor tiering and due diligence
  • Third-party AI and fourth-party risk review
  • Event-driven reassessment and monitoring
Explore about Third-Party Risk Management

Vendor SOC Report Review

A close reading of your vendors' SOC reports: scope, exceptions, carved-out subservice organizations, and the user entity controls you must run.

  • Scope and coverage check against the services you use
  • Exception and carve-out analysis
  • Complementary user entity controls mapped to owners
Learn more about Vendor SOC Report Review

SOC 2 Readiness

Scoping, gap assessment, control design, and evidence preparation before your CPA firm begins the SOC 2 examination.

  • Type 1 or Type 2 scoping and criteria selection
  • Gap assessment and control design
  • Evidence planning and practice walkthroughs
Explore about SOC 2 Readiness

ISO/IEC 27001 Readiness

Scoping, gap assessment, and ISMS build-out to prepare you for an ISO/IEC 27001:2022 certification audit.

  • ISMS scope and Statement of Applicability
  • Risk assessment and treatment plan
  • Internal audit and management review planning
Explore about ISO/IEC 27001 Readiness

HIPAA and PCI DSS Readiness

Gap assessments and control design for the HIPAA Security Rule and PCI DSS v4.0, ahead of your assessor or regulator.

  • HIPAA Security Rule risk analysis support
  • PCI DSS v4.0 scoping and gap assessment
  • Control design and evidence preparation
Learn more about HIPAA and PCI DSS Readiness

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor