--- title: Cybersecurity Risk Assessment for Ohio Practices - Capstone Technologies Group description: CIS Controls-based cybersecurity risk assessment and gap analysis for Ohio medical, legal and accounting practices, with fixes ranked by priority. canonical_url: https://captechgroup.com/services/cybersecurity-risk-assessment language: en-GB date: 2026-11-13T05:02:19Z notice: This is a machine-friendly version of the page at https://captechgroup.com/services/cybersecurity-risk-assessment. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 2605 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/services/cybersecurity-risk-assessment. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. # Cybersecurity Risk Assessment and Gap Analysis A cybersecurity risk assessment measures your practice against the CIS Controls, an established security framework, one control at a time. We come to your office, document how your systems are set up, watch how they behave, and rank the fixes by priority. It’s the method we used in the technical evaluation of Clark County’s election infrastructure in 2018, applied to medical, legal and accounting practices in Ohio. CIS Controls The established security framework we measure your practice against. 1 to 2 weeks From the start of the work to your report. Monitoring only The software only watches and reports, and we remove it when the risk assessment ends. Ranked fixes A report that tells you what to fix first. ## When a Practice Asks for a Full Risk Assessment - A partner or insurer asks how your controls measure up, and you want to know where you stand before you answer. - You have your own IT person or another provider, and you want an outside review of the setup. - You want a baseline before you change IT providers. - Your written security findings from the 15-minute call show gaps that need a closer look. You don’t have to be a managed client. We assess practices we don’t manage. ## A Short Call or a Full Risk Assessment? The 15-minute call tells you where to look. The risk assessment measures your practice, control by control. ### The 15-minute call **What it is** A 15-minute call, then written findings on five areas, including exposed passwords, phishing risk and remote access. **What the findings are based on** What you tell us on the call, plus checks we run from outside your network. It needs no access to your systems. **What you get** Written findings, each with a specific recommendation. **What it needs from you** 15 minutes. **How long it takes** Findings arrive within a few business days. **Cost** No cost and no obligation. [Book 15 minutes for written security findings →](https://captechgroup.com/security-assessment) ### The cybersecurity risk assessment **What it is** An on-site review plus a monitoring period. We measure what we find against the CIS Controls. **What the findings are based on** What we document in your office and what security monitoring software on your computers reports back. **What you get** A report with an executive summary, the gaps we found against the CIS Controls and action items ranked by priority, plus a meeting to walk through it. **What it needs from you** A visit to your office, access to your server, firewall, network storage and cloud services, and security monitoring software on every computer. The software only watches and reports, and we remove it when the risk assessment ends. **How long it takes** Plan on one to two weeks. **Cost** Quoted per job. You see the scope in writing before work starts. [Get a quote for your risk assessment →](https://captechgroup.com/contact-us) ## How the Risk Assessment Runs 1. Step 1 ### Scope and quote Tell us how many computers and locations you have and what prompted you to look. We put the scope in writing before any work starts. 2. Step 2 ### On-site visit We come to your office and document your server, firewall, network storage and cloud services: what is there and how each one is set up. 3. Step 3 About 3 to 5 days ### Monitoring We put security monitoring software on every computer. It can scan each computer for known weaknesses, watch for threats and keep track of security events. When your computers are in daily use, the monitoring runs about three to five days. - It only watches and reports to us. It does not patch, block or repair anything, so the report shows your office the way it runs today. - If it turns up something serious, we tell you right away. 4. Step 4 ### Gap analysis The CIS Controls cover everything from an inventory of your systems to planning for an incident. For each control, we compare where you are now with where you should be. Then we rank the fixes, highest priority first, and put the report together. 5. Step 5 Software removed ### Report and walkthrough You get the report, and we meet to walk through it. Then we remove the monitoring software from every computer. It stays only if you decide to keep working with us. ## Your Gap Analysis Report and Walkthrough Executive summary The short version for the people who make the decisions. Gap analysis Where you stand on each CIS Control, and where the gaps are. Ranked action items Highest priority first, so you know where to start. Walkthrough meeting We go through the report with you and answer your questions. You decide who makes the fixes: your own staff, your current provider or us. If you pick us, we quote that work too. ## The Method We Used on Clark County’s Election Infrastructure In 2018 the Ohio Secretary of State issued Directive 2018-15, directing counties to assess the security of their election infrastructure. Clark State Community College led the assessment for Clark County and brought us in for the technical evaluation. We used the CIS Controls as the foundation: document what is there, see how it runs, and record the gap for each control. The findings stay confidential. The method is the one your practice gets. [Read how the Clark County evaluation was done →](https://captechgroup.com/resources/blog/how-we-helped-secure-ohios-2018-election-infrastructure) ## Who It Fits [Medical practices](https://captechgroup.com/industry-solutions/medical-it-solutions), [law firms](https://captechgroup.com/industry-solutions/legal-it-solutions), and [accounting and financial firms](https://captechgroup.com/industry-solutions/financial-it-solutions) in Springfield, Dayton and Columbus, with or without IT staff of their own. ## How It Is Priced We quote every risk assessment as project work. The quote depends on the size of your office: how many computers and locations you have, and what there is to document. ## Questions No. It measures your environment against the CIS Controls and gives you a ranked list of fixes. It is not an audit opinion or a compliance certification. Yes, and that is the difference from the 15-minute call, which needs none. We document your server, firewall, network storage and cloud services on site, and security monitoring software runs on every computer. The software watches and reports. It does not patch, block or repair anything. Plan on one to two weeks once the work starts. When your computers are in daily use, the monitoring runs about three to five days. Then we put the findings and the report together. No. We remove it from every computer when the risk assessment ends. It stays only if you decide to keep working with us. We tell you right away. You don’t wait for the report. The software only watches and reports, so you decide who deals with it: your own staff, your current provider or us. ## See What Your Risk Assessment Would Cover In your message, say you want a quote for a risk assessment. Tell us roughly how many computers and locations you have and what prompted you to look. Not sure you need the full risk assessment? [Book 15 minutes for written security findings →](https://captechgroup.com/security-assessment) ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-11-13T05:02:19Z", "datePublished": "2026-11-13T04:50:48Z", "description": "CIS Controls-based cybersecurity risk assessment and gap analysis for Ohio medical, legal and accounting practices, with fixes ranked by priority.", "headline": "Cybersecurity Risk Assessment", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/services\/cybersecurity-risk-assessment" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/services\/cybersecurity-risk-assessment" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```