Cybersecurity Assessment

A cybersecurity assessment is the independent examination of an organisation's or a system's security posture. It need not be tied to a specific certification scheme: penetration testing, vulnerability assessment, architecture review, maturity assessment (e.g. NIST CSF, CIS Controls), or a red-team exercise all fall under this heading. The output is a findings and recommendations report, not a certificate.

• Organisations wanting to measure their security posture
• Firms wanting a gap analysis before certification
• Companies with a contractual obligation for periodic penetration testing
• Teams wanting to verify a new system or product before going live
• Organisations reassessing their posture after an incident

Not mandatory in itself. However, many frameworks and regulations impose a periodic testing obligation: PCI DSS requires penetration testing and scanning, ISO/IEC 27001 expects a technical compliance review, and regulations such as NIS2 require the effectiveness of risk-management measures to be assessed.

• Defining the scope and rules of engagement
• Compiling the asset inventory and the attack surface
• Vulnerability scanning and validation
• Penetration testing: external network, internal network, web application, mobile application, wireless
• Configuration and hardening review
• Identity and access management review
• Architecture and segmentation assessment
• Social engineering and awareness testing (if within scope)
• Maturity assessment (against frameworks such as NIST CSF, CIS Controls)
• Prioritising and reporting findings by risk level
• Post-remediation verification testing

1. 1Determining Scope and ProgrammeThe sites and processes to be audited, and the audit duration the scheme requires, are determined.
2. 2Pre-assessmentA gap analysis is optionally carried out; gaps become visible before the main audit.
3. 3On-site AuditRecords review, site observation and worker interviews are carried out against the scheme's checklist.
4. 4Reporting of FindingsFindings are reported according to the scheme's classification. The output of these schemes is an audit report, not a certificate.
5. 5Corrective Action and Follow-upA corrective action plan is submitted for the findings; it is closed with a follow-up audit under the scheme.

The validity period of audit reports is set by the scheme and is mostly between one and two years. The report is used for the period the buying brand accepts.

• Organisation and site details
• Headcount and shift pattern
• Legal permits and licences
• Relevant policies and procedures
• Payroll, time and personnel records

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The number of sites to be audited and the headcount
• The audit duration the scheme prescribes
• Whether a pre-assessment (gap analysis) is requested
• Whether a follow-up audit is required

Most of these schemes produce audit reports, not documents, and are subject to the scheme owner's (e.g. Sedex, amfori, RBA) own approval system; Accreditation in the classical sense is not found in every scheme. Auditor competence and report validity are determined by the scheme owner's rules.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• IEC 62443Industrial Automation Cybersecurity
• Common Criteria
• ISO/IEC 27001Information Security Management
• ISO/IEC 27017Cloud Security
• ISO/IEC 27018Personal Data in the Cloud
• ISO/IEC 27701Privacy Information Management
• ISO/IEC 42001Artificial Intelligence Management System
• SOC 1Financial Reporting Controls