Cybersecurity Assessment
Cybersecurity assessment and risk assessment
An honest, practical review of your current environment — control gaps, exposures and priority risks — and a remediation plan ranked by business impact.
What does a cybersecurity assessment include?
A cybersecurity assessment reviews how well an organisation's critical systems and data are protected. It typically covers identity and sign-in controls, privileged access, email security, device and patch management, cloud and Microsoft 365 configuration, backups and recovery, data sharing, staff awareness and incident readiness — and ends with prioritised risks and a practical remediation plan.
Focus on the risks that matter
A useful assessment is not a 200-page report of every theoretical weakness. It identifies what is critical to your business, how an attacker would realistically get to it, and which controls would make the biggest difference for the effort involved.
Most incidents affecting small and mid-sized organisations still start the same way: a phished password without multi-factor authentication, an unpatched device, an over-privileged account, or backups that turn out not to work. We check those fundamentals thoroughly before anything exotic. Our guide to POPIA and cybersecurity explains the legal angle.
What we review
Identity and sign-in
Multi-factor authentication, conditional access, password policy and stale accounts.
Privileged access
Who holds admin rights, how they are used and protected.
Email security
Phishing protection, SPF, DKIM, DMARC and mail-flow rules.
Devices and patching
Endpoint protection, encryption, update status and management coverage.
Cloud and Microsoft 365
Tenant configuration, sharing, logging and alerting.
Backup and recovery
What is backed up, whether restores have been tested, and recovery objectives.
Data protection
Where sensitive and personal information lives and who can reach it.
People and response
Awareness, reporting routes and incident response readiness.
The assessment process
01
Scope
Agree critical systems, data and the depth of review.
02
Review
Configuration review, interviews and evidence sampling.
03
Prioritise
Rate each finding by likelihood and business impact.
04
Report
A clear summary for leadership and detail for technical teams.
05
Remediate
Implement the plan with us, or with your own team.
Connected capabilities
Where this connects to the rest of the work
Technology does not operate in silos. These are the capabilities that most often sit alongside this one in a real engagement.
FAQ
Frequently asked questions
Is a security assessment the same as a penetration test?
No. A penetration test attempts to exploit specific systems; an assessment reviews controls across the whole environment. Many organisations get more value from an assessment first, then targeted testing.
How often should we have a cybersecurity assessment?
At least annually, and after significant change — a cloud migration, acquisition or major new system.
Will the assessment disrupt our operations?
No. It is mainly configuration review and conversations with the right people.
Does the assessment help with POPIA compliance?
Yes. POPIA requires identifying reasonably foreseeable risks to personal information and maintaining safeguards against them — an assessment provides exactly that evidence.
Ready when you are
Know where you stand
A focused assessment gives you a prioritised list of what to fix first — and why.