CIS Controls Assessment

A set of 18 prioritised safeguards published by the Center for Internet Security, drawn from how attacks actually happen rather than from theory. They're grouped into Implementation Groups so a small business isn't measured against the same expectations as a bank. The value is in the ordering — the Controls tell you which basics close the most risk, which is exactly what most security shopping lists lack.

No, and you should be wary of anyone offering it. CIS is a framework for assessing and improving security, not a certification scheme, and there is no certificate to issue. What you can have is a documented assessment of where your environment stands against the Controls, a remediation plan, and evidence of progress over time. That is what insurers and enterprise customers are actually asking for.

A vulnerability scan tells you which systems have known technical weaknesses. A CIS assessment asks whether the controls and processes exist at all — whether you have an asset inventory, whether administrative access is controlled, whether backups are tested, whether logs would tell you anything after an incident. A scan finds holes in what you have. A CIS assessment finds what you don't have.

Those are two controls out of eighteen, and they're the two almost everyone already has. The gaps we find are rarely in the products — they're in the areas nobody owns: unmanaged devices, administrative accounts that were never reviewed, backups nobody has restored from, and no record of who has access to what.

A documented view of your environment measured against the Controls, findings prioritised by business risk, and a remediation plan in the order we'd tackle it. Written to be read by someone who has to make a decision, not only by an engineer.

Assessment work is largely read-only — we're examining configuration and process, not changing them. Anything we would change is agreed with you first and scheduled around your operations.