Cybersecurity Risk Assessment and Gap Analysis
A cybersecurity risk assessment measures your practice against the CIS Controls, an established security framework, one control at a time. We come to your office, document how your systems are set up, watch how they behave, and rank the fixes by priority. It’s the method we used in the technical evaluation of Clark County’s election infrastructure in 2018, applied to medical, legal and accounting practices in Ohio.
When a Practice Asks for a Full Risk Assessment
- A partner or insurer asks how your controls measure up, and you want to know where you stand before you answer.
- You have your own IT person or another provider, and you want an outside review of the setup.
- You want a baseline before you change IT providers.
- Your written security findings from the 15-minute call show gaps that need a closer look.
You don’t have to be a managed client. We assess practices we don’t manage.
A Short Call or a Full Risk Assessment?
The 15-minute call tells you where to look. The risk assessment measures your practice, control by control.
The 15-minute call
What it is
A 15-minute call, then written findings on five areas, including exposed passwords, phishing risk and remote access.
What the findings are based on
What you tell us on the call, plus checks we run from outside your network. It needs no access to your systems.
What you get
Written findings, each with a specific recommendation.
What it needs from you
15 minutes.
How long it takes
Findings arrive within a few business days.
Cost
No cost and no obligation.
The cybersecurity risk assessment
What it is
An on-site review plus a monitoring period. We measure what we find against the CIS Controls.
What the findings are based on
What we document in your office and what security monitoring software on your computers reports back.
What you get
A report with an executive summary, the gaps we found against the CIS Controls and action items ranked by priority, plus a meeting to walk through it.
What it needs from you
A visit to your office, access to your server, firewall, network storage and cloud services, and security monitoring software on every computer. The software only watches and reports, and we remove it when the risk assessment ends.
How long it takes
Plan on one to two weeks.
Cost
Quoted per job. You see the scope in writing before work starts.
How the Risk Assessment Runs
-
Step 1
Scope and quote
Tell us how many computers and locations you have and what prompted you to look. We put the scope in writing before any work starts.
-
Step 2
On-site visit
We come to your office and document your server, firewall, network storage and cloud services: what is there and how each one is set up.
-
Step 3 About 3 to 5 days
Monitoring
We put security monitoring software on every computer. It can scan each computer for known weaknesses, watch for threats and keep track of security events. When your computers are in daily use, the monitoring runs about three to five days.
- It only watches and reports to us. It does not patch, block or repair anything, so the report shows your office the way it runs today.
- If it turns up something serious, we tell you right away.
-
Step 4
Gap analysis
The CIS Controls cover everything from an inventory of your systems to planning for an incident. For each control, we compare where you are now with where you should be. Then we rank the fixes, highest priority first, and put the report together.
-
Step 5 Software removed
Report and walkthrough
You get the report, and we meet to walk through it. Then we remove the monitoring software from every computer. It stays only if you decide to keep working with us.
Your Gap Analysis Report and Walkthrough
You decide who makes the fixes: your own staff, your current provider or us. If you pick us, we quote that work too.
The Method We Used on Clark County’s Election Infrastructure
In 2018 the Ohio Secretary of State issued Directive 2018-15, directing counties to assess the security of their election infrastructure. Clark State Community College led the assessment for Clark County and brought us in for the technical evaluation. We used the CIS Controls as the foundation: document what is there, see how it runs, and record the gap for each control. The findings stay confidential. The method is the one your practice gets.
Who It Fits
Medical practices, law firms, and accounting and financial firms in Springfield, Dayton and Columbus, with or without IT staff of their own.
How It Is Priced
We quote every risk assessment as project work. The quote depends on the size of your office: how many computers and locations you have, and what there is to document.
Questions
No. It measures your environment against the CIS Controls and gives you a ranked list of fixes. It is not an audit opinion or a compliance certification.
Yes, and that is the difference from the 15-minute call, which needs none. We document your server, firewall, network storage and cloud services on site, and security monitoring software runs on every computer. The software watches and reports. It does not patch, block or repair anything.
Plan on one to two weeks once the work starts. When your computers are in daily use, the monitoring runs about three to five days. Then we put the findings and the report together.
No. We remove it from every computer when the risk assessment ends. It stays only if you decide to keep working with us.
We tell you right away. You don’t wait for the report. The software only watches and reports, so you decide who deals with it: your own staff, your current provider or us.
See What Your Risk Assessment Would Cover
In your message, say you want a quote for a risk assessment. Tell us roughly how many computers and locations you have and what prompted you to look.
Not sure you need the full risk assessment? Book 15 minutes for written security findings →
