Maturity Level Assessments

Whichever one your obligations actually reference. SOC 2 if enterprise customers are the constraint, NIST SP 800-171 and CMMC if you hold controlled unclassified information, ISO 27001 if international customers or a parent require it, NIST CSF if you need a broad program benchmark, CIS Controls if you need to improve fast. If several apply, we assess once against the superset and map the results, rather than running the same review repeatedly.

In several states, yes. Ohio, Utah and Connecticut among others provide a safe harbor or affirmative defense in breach litigation for organizations maintaining a written cybersecurity program conforming to a recognized framework, and Tennessee offers a similar defense tied to the NIST Privacy Framework. In every case the benefit depends on genuine implementation rather than adoption on paper, which is exactly what an assessment plus testing evidences.

An audit tells you whether you pass. An assessment tells you where you stand and what to do about it, without the constraint of an opinion that has to be defensible to a professional body. We can be considerably more direct about what is not working, which is more useful before an audit than after one.

Typically two to four weeks depending on scope and how readily documentation and stakeholders are available. Most of the elapsed time is interviews and evidence review rather than analysis. We can move faster against a hard deadline, but the quality of the output tracks the quality of the access we get.

A current-state rating against each control area, a target state agreed with you, a gap analysis explaining the distance between them in plain terms, and a prioritized roadmap sequenced by risk reduction per unit of effort. The roadmap is the part clients use most, and we write it so it survives contact with a budget process.

We do not sell remediation consulting off the back of an assessment, which keeps the findings honest. What we do provide is a roadmap specific enough that your team or your existing partners can act on it, and testing afterwards to verify that what was implemented actually works.