Advisory · Cyber Assurance Assessment
Cyber security assessment services
Understand your cyber risk before investing in more technology. Our Cyber Assurance Assessment shows where you stand against a recognised framework, what to fix first and what it will cost, in a form your board can act on. Delivered by vetted specialist partners, with Threat Protect accountable throughout.
Definition
What is a cyber security assessment?
A cyber security assessment is a structured review of how well your people, processes and technology protect the organisation, measured against a recognised framework. It answers the three questions that drive investment: where are we today, what is good enough, and what should we fix first?
The Cyber Assurance Assessment is our version of it. Vetted specialist partners do the assessment. Threat Protect scopes it, oversees it and stays your single point of accountability. It replaces guesswork and vendor pressure with an evidenced picture and a sequenced plan.
Which one you need
Assessment, audit, gap analysis or penetration test?
These terms are often used loosely, and you can end up buying the wrong one. Each answers a different question, and most organisations should start with the broadest.
| The question it answers | What you get | |
|---|---|---|
| Cyber security assessment | How good is our security overall, and what comes first? | A scored baseline and a roadmap |
| Cyber security audit | Do we meet a defined standard or policy? | Findings against that standard, pass or fail |
| Gap analysis | What is missing against this framework? | A list of gaps, ranked |
| Cyber risk assessment | What could hurt the business, and how badly? | A risk register in business terms |
| Vulnerability assessment | Which technical weaknesses do our systems have? | A validated, ranked list of issues |
| Penetration test | How far could an attacker actually get? | Proof of what can be exploited |
When to ask for one
When a cyber security assessment earns its cost
- The board has asked how exposed the organisation is, and nobody can answer with evidence
- A customer, insurer or regulator is asking questions you cannot yet answer honestly
- You are about to spend real money on security and want to know it is the right spend
- A new IT or security leader needs a baseline to work from
- You have merged, acquired a business or moved to the cloud, and the old picture no longer holds
- You have had an incident or a near miss, and want an outside view of what it exposed
Scope
What the assessment covers
A complete read of your security posture across people, process and technology. Scope follows your risk, so the depth varies by area.
Governance and risk
Who owns security, how decisions get made, what the board sees and whether your policies reflect what really happens.
People and awareness
Roles, training and how well staff handle the attacks they are most likely to meet.
Identity and access
Multi-factor authentication, privileged accounts, joiners and leavers, and how access gets reviewed.
Protecting systems and data
Patching, configuration, cloud and Microsoft 365 settings, data handling and network separation.
Detection and response
What you can see, who is watching, and whether you have a plan that people have rehearsed.
Suppliers
Which suppliers could hurt you most, and what you have asked of them. The 2025/26 Cyber Security Breaches Survey found that 48% of large UK businesses review the risks posed by their immediate suppliers.
Backup and recovery
Whether you could restore the systems that matter, in the time the business can tolerate, and whether that has been tested.
Frameworks
The frameworks we assess against
Partners assess against whichever framework fits your situation. If a regulator or a major customer already sets the standard, start there. Our partners include firms holding NCSC Assured Cyber Security Consultancy or Cyber Advisor status.
| Best for | How it is structured | |
|---|---|---|
| ISO 27001 | Customers who expect a certifiable standard | A management system, with 93 reference controls in Annex A |
| NIST CSF 2.0 | A clear board-level view of maturity | Six functions: Govern, Identify, Protect, Detect, Respond and Recover |
| NCSC CAF 4.0 | Essential services and critical national infrastructure | 4 objectives, 14 principles and 41 contributing outcomes |
| CIS Controls | A practical, prioritised technical baseline | 18 controls, with implementation groups by size and risk |
How it is scored
A cyber maturity score you can re-measure
Each area is scored against the framework and an agreed target, then every gap is ranked by risk rather than by product. That gives you a baseline to re-measure against, and shows the board whether risk is falling. A CAF assessment works a little differently: it uses evidence and expert judgement against indicators of good practice, so we report it in CAF’s own terms.
The process
How a cyber security assessment works
1.Scope
We agree the framework, the sites and systems in scope, the people to speak to and what the board needs from it.
2.Gather evidence
The assessor reviews policies and records, interviews key people and samples technical settings, so scores rest on what is really happening.
3.Score and rank
Each area is scored, then gaps are ranked by likelihood, business impact and the cost to fix.
4.Report and roadmap
You get the findings and a costed, sequenced plan, with a straight recommendation on what to keep, change and drop.
5.Brief the board
The risk picture and the plan are presented to your leadership, so they can decide what to fund.
What you walk away with
Documents you can act on, not a slide deck.
- A scored posture baseline you can re-measure against over time
- A gap analysis that ranks every gap by risk, not by product
- A board-ready risk picture, written without jargon
- A costed, sequenced roadmap that tackles the highest risks first
- A straight recommendation on what to keep, what to change and what to drop
- One accountable point of contact at Threat Protect, start to finish
Cost
What a cyber security assessment costs
Pricing is on application. We scope it on a short call and quote before any work starts. These are the things that move the cost.
- The size of the organisation, and the number of sites and business units
- Which framework you are assessed against, and how much evidence it needs
- How many people need interviewing
- Whether technical testing is added, such as a vulnerability assessment
- Whether you want the board briefing and re-measurement included
FAQ
Questions buyers actually ask
What is included in a cyber security assessment?
A review of governance, people, identity, system and data protection, detection and response, suppliers and recovery, measured against a recognised framework. You receive a scored baseline, a gap analysis ranked by risk, a board-ready risk picture and a costed roadmap.What is the difference between a cyber security assessment and an audit?
An audit checks whether you meet a defined standard or policy, and reports findings against it. An assessment is broader and more forward-looking: it scores your maturity, ranks the gaps by risk and sets out what to do next. An assessment is not a certification audit, though it is often the best preparation for one.How long does a cyber security assessment take?
As a guide, most take a few weeks from kick-off to report. It depends on the size of the organisation, the number of sites, the framework and how quickly evidence and people are available. We agree a timetable at scoping.How often should we have a cyber security assessment?
Many organisations re-measure once a year, and after a major change such as an acquisition, a cloud migration or an incident. The scored baseline is there so that each round shows whether risk is really falling.Which framework should we be assessed against?
Start with whatever your regulators or major customers already expect. If nothing is set, NIST CSF 2.0 gives a clear board-level view, ISO 27001 suits organisations heading towards certification, the NCSC CAF suits essential services, and the CIS Controls give a practical technical baseline.Who carries out the assessment?
Vetted specialist partners, matched to your sector and framework. They include firms holding NCSC Assured Cyber Security Consultancy or Cyber Advisor status. Threat Protect scopes the work, oversees delivery and remains your single point of accountability.Does an assessment include a penetration test?
Not by default. An assessment looks at the whole organisation, and a penetration test looks at how far an attacker could get into specific systems. They work well together, and technical testing can be added to the scope if you need it.
Start with an honest read of where you are.
A structured assessment, a board-ready risk picture and a costed roadmap. Book a call and we will scope it for your company.
Book a call Also available in AWS Marketplace