Security Risk Assessment
A structured, framework-aligned assessment of your organization's security posture across people, process, and technology.
- Outcome
- A defensible view of your enterprise risk.
- Timeline
- 4 phases1 week · 2–3 weeks · 1–2 weeks · 1 week
- Mapped to
- NISTISO/IEC · COBIT · HIPAA
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
A structured look at your whole organisation's security risks, ranked so leadership knows what to fund first.
- Leadership or a board is asking where your biggest security risks are
- You're planning a security budget or roadmap
- You're preparing for ISO 27001 or another framework
- You've grown fast and nobody owns the full risk picture
- You need a certificate, not just a risk viewISO/IEC 27001 Readiness
- You need technical proof of exploitable weaknessesPenetration Testing
- Key systems, data and suppliers
- Existing policies and past audit or test reports
- Time with IT, engineering and a business owner
Still not sure? Take the 2-minute check
What you walk away with.
- Enterprise-wide risk register with likelihood × impact scoring
- Gap analysis against your chosen framework (NIST CSF, ISO 27001, HIPAA, PCI)
- 18-month remediation roadmap with effort × cost estimates
- Board-ready summary and engineer-ready detail
What we cover
Agreed in writing before testing starts.
- Governance, policies, and organizational structure
- Asset inventory + data-classification review
- Access control + IAM + privileged access management
- Vulnerability management + change management processes
- Incident response + business continuity + disaster recovery
- Third-party risk management
- Physical + environmental controls (interview-based)
- Deep technical testing (see Vulnerability Assessment, Pen Testing)
- On-site physical inspection (available as add-on)
How we run it.
- 01
Framework selection
NIST CSF? ISO 27001? HIPAA? PCI DSS? A hybrid? We help you pick the one that matches your regulators and industry.
- 02
Evidence gathering
Interviews, policy review, control-configuration review, sample-based testing. Two-week window, typically.
- 03
Gap analysis
Every control mapped, evidenced, and scored — organized by control family and business function.
- 04
Risk quantification
Each gap translated to a risk statement with likelihood, impact, and inherent-vs-residual scoring (NIST SP 800-30 method).
- 05
Roadmap
Phased remediation: quick wins, medium-term projects, strategic initiatives — each sized.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- NIST SP 800-30 risk method
- NIST CSF 2.0 maturity view
- ISO/IEC 27005 risk management
- Asset, threat and vulnerability mapping
- Likelihood and impact scoring
- Control gap analysis
- Risk register with owners
- Treatment options and cost
- Quick wins versus structural fixes
- Board-level risk summary
- 12-month remediation roadmap
- Inputs for an ISO 27001 SoA
What lands in your inbox.
- Enterprise Risk Register (spreadsheet + PDF summary)
- Framework Gap Analysis matrix
- Executive board deck (10–15 slides)
- Remediation Roadmap with quarterly milestones
- Optional annual reassessment engagement
Defensible under audit.
- NIST
- ISO/IEC
- COBIT
- HIPAA
From call to report.
- 01Scoping
1 week
- 02Evidence gathering
2–3 weeks
- 03Analysis + scoring
1–2 weeks
- 04Roadmap + delivery
1 week
Asked before every engagement.
Is this the same as an audit?
No. An SRA is a gap-analysis + risk-quantification exercise designed to feed remediation planning. An audit is an independent-attestation exercise. Many organizations run an SRA to prepare for audit.
How is this different from a Vulnerability Assessment?
A VA is technical — which vulnerabilities exist. An SRA is holistic — which risks exist across people, process, and technology, and how they should be prioritized.
Can we use this to inform ISO 27001 certification?
Yes. The output is designed to feed your ISO 27001 Statement of Applicability inputs and risk-treatment plan directly.
Ship a defensible risk story.
Board-ready output, auditor-defensible methodology, engineer-executable roadmap. Typical delivery: 6–8 weeks.