In this video
- Step 1 — configuration collection across Microsoft 365, Active Directory, Windows Server, SQL Server and FortiGate or Sophos firewalls
- Step 2 — automated benchmark comparison across hundreds of configuration controls
- Step 3 — a findings report giving a pass or fail per control, with severity from critical through to low
- Step 4 — remediation sequenced by business impact, security risk and what can realistically be implemented
- Why even well-run environments come out of an assessment with findings
It is a read, not a change
Configuration data is collected and compared. Nothing is modified during the assessment itself. Scope is agreed up front in a short scoping conversation so you know exactly which systems are being looked at before anything begins.
The comparison is not a manual checklist. Professional CIS auditing tooling evaluates hundreds of configuration controls per platform, which is what makes it repeatable and what makes a retest meaningful.
The output is a sequence, not a list
A raw benchmark run produces far more findings than any business can action at once. The value is in the ordering. Each finding is weighed against three questions: what would happen to operations if this gap were exploited, how likely is it to be exploited and how much damage would follow, and what can realistically be changed without disrupting the business.
What comes out is a roadmap with a clear starting point rather than several hundred undifferentiated items.
Frequently asked questions
How disruptive is the assessment?
Configuration data is read, not changed. Nothing is modified during collection, and scope is agreed with you before it starts.
What do we receive at the end?
A findings report with a pass or fail against each control and a severity rating, plus a prioritised remediation roadmap. The report is written so it can be handed to an insurer, an auditor or a board.
Will it produce hundreds of items we cannot action?
The roadmap is sequenced rather than dumped. Findings are ordered by business impact, security risk and operational feasibility, so there is always a clear place to start.
Book a CIS Assessment
Covering Microsoft 365, Active Directory, Windows Server, SQL Server and firewall infrastructure — an evidence-based picture of your security posture across the environment.
Contact Us
