Security assessment · Dallas–Fort Worth, Texas
Cybersecurity Consulting & Security Assessments
A customer sent a security questionnaire. Your cyber-insurance renewal is asking for evidence. The board wants to know where the company actually stands. We measure the controls you have against NIST CSF and hand you a roadmap your team can execute in order.
What the assessment covers
A structured review of the controls that decide whether a mid-market company can answer a customer, an insurer, or an auditor — without buying a new tool first.
Identity and access
Who can log in, with what, from where. Admin accounts, MFA coverage, joiners and leavers, service accounts, and the vendor accounts nobody remembers creating.
Endpoints, email, and backups
Patch status, endpoint protection, email authentication (SPF, DKIM, DMARC), and one question that matters more than the backup tool: does a restore actually work?
Network and cloud
Remote access, segmentation between office, plant, and warehouse systems, cloud configuration, logging, and the systems that hold customer or patient data.
A prioritized gap list, not a binder
The output is written to be used. Every finding has a place in the sequence, an owner on your side, and a reason it comes before the next one.
- Control-by-control findings, written in plain language and mapped to the NIST CSF 2.0 functions.
- A prioritized remediation roadmap: fix now, fix this quarter, fix this year — with an owner and an effort estimate for each item.
- A one-page exposure summary for the board, insurer, or customer that asked the question.
- A policy and evidence inventory: what exists, what is missing, and what is out of date.
- A 90-minute readout with the people who will do the work, not just the executive sponsor.
- The working file. It is yours, in a format your team can keep updating after we leave.
15 business days, one readout
The Security & AI Risk Diagnostic runs 15 business days from kickoff and includes two on-site or two full remote workshop days. On day 15 you get the written findings and a 90-minute readout with the people who will do the work.
If the findings point to ongoing ownership instead of a project, the diagnostic converts to the Fractional CISO retainer at $9,500 a month for two days a week, 90-day initial term.
How the assessment runs
Kickoff and scope
We agree the sites, systems, and people in scope, and the deadline you are working to: a customer, an insurer, an audit, or a board meeting.
Evidence and interviews
We read the configurations and policies you actually run, and talk to the people who operate them. Two workshop days, on site or remote, are included.
Findings and readout
We write the gap list, the roadmap, and the exposure summary, then present them on day 15. You decide whether to fund the fix, and in what order.
What an assessment is not
An assessment is a review of the controls you have, not a demonstration of what an attacker can do to them. We say that plainly because the difference matters when a customer or insurer reads the report.
Testing is a separate engagement
We do not personally perform exploitation, red-team work, or assessor certification. Vulnerability review and penetration testing are scoped and managed with vetted testing partners, then translated into fixes your team can ship.
Security & AI Risk Diagnostic
Paid at kickoff. The fee is credited against a follow-on engagement started within 45 days. Never a free audit.
Assessment questions
Is a security assessment the same as a penetration test?
No. A security assessment reviews controls, policies, configurations, and evidence. A penetration test validates specific technical weaknesses. We scope and manage testing with vetted testing partners; it is a separate engagement with its own scope and rules of engagement.
How long does the assessment take?
15 business days from kickoff. It includes two on-site or two full remote workshop days with your team.
What do you need from us?
Read-only access to configuration and policy evidence, plus about two workshop days with IT, operations, and finance. We do not need standing admin access, and we do not need production credentials to write the report.
Which framework do you assess against?
NIST CSF 2.0 is the spine. Where you have a specific deadline, we map the same findings to SOC 2, ISO 27001, HIPAA, or PCI DSS so you are not paying for two assessments.
Start with the paid diagnostic.
Fixed scope, 15 business days, and a written readout you can take to a customer, an insurer, or the board. Tell us the deadline you are working to.