Risk & Gap Assessments

Find out how your security program measures up against a recognized framework, and get a prioritized roadmap to close the gaps that matter most.

What a gap assessment is

Know where you stand, and what to fix first

A gap assessment measures your security program against a recognized framework. We review your policies, processes and technical controls, score how mature each area is today, and show you exactly where you fall short of where you need to be.

It is the right first step when you need a clear baseline: before a certification or audit, when a customer or contract sets security requirements, or when leadership asks how secure the organization really is.

Not ready for a penetration test yet?A penetration test shows how well your controls hold up against a real attacker. If those controls are still being built, start with a gap assessment, then test once the foundations are in place.About penetration testing

Is this for you?

Common reasons to start here

  • A customer, partner or contract asks you to show your security controls
  • Your cyber insurance renewal asks detailed security questions
  • You are preparing for ISO/IEC 27001 certification
  • You supply the defence sector and need to meet CPCSC or CMMC requirements
  • New leadership or the board wants an honest baseline
  • A penetration test or incident exposed gaps in the basics

Gap or risk?

Two questions your leadership needs answered

Gap and risk assessments answer different questions. Together, they tell you what is missing and which of those gaps matter most to your business.

Gap assessment

What are we missing?

  • Measures your controls against a framework such as NIST CSF 2.0 or ISO/IEC 27001
  • Scores the maturity of each area, from governance and policy to technical controls
  • Shows the distance between where you are and where you need to be

Risk assessment

What could hurt us most?

  • Looks at the threats you face and the systems and data that matter most
  • Weighs how likely each threat is and what it would cost the business
  • Puts your security spending where it reduces the most risk

How we bring them together: your roadmap ranks every gap by the risk it poses, so the first things you fix are the ones that protect the business most.

Frameworks

Measured against the standard that matters to you

We assess against recognized frameworks, so your results mean something to customers, auditors and insurers, not just to us.

  • Full program baseline

    NIST CSF 2.0

    Covers your whole security program across six functions: Govern, Identify, Protect, Detect, Respond and Recover. A strong choice when you want a complete picture of where you stand.

  • Practical and prioritized

    CIS Controls v8

    Eighteen practical control areas, grouped into Implementation Groups so the assessment fits your size. Our quickest assessment and a good starting point for small and mid-sized organizations.

  • Certification readiness

    ISO/IEC 27001

    Assesses your information security management system and Annex A controls against the standard, so you know what to close before your certification audit.

  • Defence suppliers

    CPCSC and CMMC

    For organizations in the defence supply chain: the Canadian Program for Cyber Security Certification for Canadian contracts, and CMMC for U.S. Department of Defense work.

Not sure which framework fits? We'll recommend one based on your industry, your customers and your goals. How long an assessment takes depends on the framework and the size of your organization; a CIS Controls assessment is the quickest.

How it works

A collaborative assessment, not an audit

We work alongside your team. The goal is an accurate picture and a plan you can act on, not a pass or fail grade.

  1. Scope

    We agree on the framework, which parts of the organization are in scope and who we need to speak with.

  2. Review

    We review your policies, procedures, configurations and other evidence of how your controls work today.

  3. Interviews

    We walk through each area with the people who run it, so the results reflect how things really work.

  4. Score

    We score the maturity of each area and rank the gaps by the risk they pose to your business.

  5. Roadmap

    You receive a prioritized roadmap and an executive briefing for your leadership team.

What you receive

Clear answers your leadership can act on

Every gap assessment ends with three things, written for the people who make decisions as well as the people who do the work.

  • Maturity scores per area

    A clear score for each area of the framework, showing where you are strong and where you fall short.

  • Prioritized roadmap

    The steps to close each gap, ordered by risk and effort, so you know what to tackle first and what can wait.

  • Executive briefing

    A plain-language briefing for leadership: where you stand, the biggest risks and what it will take to close the gaps.

Help working through your roadmap

Delivered by practitioners with over 20 years of experience, holdingCISSP · CISA · CISM · CGEIT · OSCP · OSWP · KLCP · ECIH

Get started

Request a gap assessment

Tell us a little about your organization and what's driving the assessment. We'll recommend a framework and scope, then send you a quote.

  • A recommendation on the right framework for you
  • A scope and quote based on your size and goals
  • Prefer to talk first? Choose the call option and book a 45-minute call
Your assessment

A few questions so we can recommend the right framework and scope.

How would you like to start? (required)

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Which framework would you like to be assessed against? (required)

Choose all that apply.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

What's driving the assessment?

Choose all that apply.

About you

Who we'll be working with.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Answer only if you chose “Tell us about your needs and get a quote” for “How would you like to start?”.

Anything that helps us scope the work, such as locations, systems in scope or a deadline you're working toward.

Answer only if you chose “Skip the questions and book a 45-minute call with us” for “How would you like to start?”.

Choose a time for your call (required)

Times are shown in your time zone. We'll send a Microsoft Teams invitation to your email.

To choose a time without JavaScript, use the booking page.

FAQ

Questions about gap assessments

How long does a gap assessment take?

It depends on the framework and the size of your organization. A CIS Controls assessment is the quickest; NIST CSF 2.0 and ISO/IEC 27001 cover more ground and take longer. We confirm the timeline when we scope the work.

Do we need to have a security program in place first?

No. A gap assessment is often the best place to start when your program is new or informal. It shows you what to build first.

What's the difference between a gap assessment and a penetration test?

A gap assessment reviews your controls against a framework to find what is missing. A penetration test attacks your systems to see whether the controls you have actually hold up. Most organizations get more from a penetration test once the gaps in the basics are closed.

Which framework should we choose?

It depends on who is asking. Customers and insurers often recognize NIST CSF or CIS Controls, ISO/IEC 27001 suits organizations working toward certification, and defence suppliers need CPCSC or CMMC. We will recommend one when we scope the work.

Can you help us close the gaps afterwards?

Yes. We can help you write or update policies, advise you as you work through the roadmap, and test your controls with a penetration test once they are in place.