Fee
Register to see indicative feesConfirmed in writing after scoping01 / Assessment · Standard
Security Assessments
Someone has asked you to prove your security position, and what exists today is a spreadsheet nobody is willing to sign.
Assurance & ComplianceAssessment
Typical duration
3 to 6 weeksDepends on scope and environment sizePrimary artefact
Control-mapped findings reportPlus three moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Security Assessments is
Evidence-based assessment of your security controls against a named framework: vulnerability assessment, control review, configuration review or a combination, scoped to the question you actually need answered.
And what this service produces
It produces findings mapped to a control framework with severity ratings and a sequenced remediation path, rather than a scanner output with a cover page.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- You need an evidenced position for a customer, auditor or insurer.
- Your last assessment was self-scored.
- Your team is preparing for certification or a framework deadline.
- The board is asking for independent verification.
02
The usual trigger
- A customer or tender requires an independent assessment.
- An insurer has asked for evidence.
- Certification is being planned.
- An internal claim of compliance needs testing.
06 / The obligation
Evidence-based versus questionnaire-based, and why the distinction is the whole thing
The word that matters in an assessment is evidence-based.
Claimed versus demonstrated
A defensible assessment separates what is claimed from what can be demonstrated: it inspects configurations, samples systems and tests controls rather than accepting a questionnaire answer.
Where the report earns its fee
Organisations routinely report a control as operating because the policy exists, and the assessment finds it enforced on some systems and not others. That is a materially different position, and it is the one an auditor will find.
The cost of the cheapest assessment
The cheapest assessment is usually the most expensive one over two years. A questionnaire-based report that says you are compliant produces confidence rather than information, and the gap surfaces later under someone else's scrutiny.
A claimed control and a demonstrated control are different things, and a report that does not distinguish them is not an assessment.
07 / What you receive
Four artefacts. Each one yours to keep.
- 01
Control-mapped findings report
Every finding mapped to the framework control it breaches, with severity and evidence.
ReportTechnical and executive versions - 02
Evidence pack
What was tested, how, and what the test showed, so a third party can follow the reasoning.
Evidence setAudit-ready - 03
Prioritised remediation sequence
What to fix first, effort-estimated and costed so the next phase can be scoped.
Sequenced planBudget-ready - 04
Executive summary
The position and the material findings in three pages.
SummaryBoard pack
08 / Scope
The whole system is visible before work begins.
Scoping
- Framework and control set agreed
- Environment boundary defined
- Evidence requirements stated up front
Technical assessment
- Vulnerability assessment across in-scope systems
- Configuration review against the baseline
- Patch and hardening verification
Control review
- Control design reviewed
- Operating effectiveness sampled
- Evidence tested, not accepted
Analysis
- Findings mapped to framework controls
- Severity rated against exploitability and impact
- False positives removed before reporting
Reporting
- Technical and executive reports
- Remediation sequenced and costed
- Readout session
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Scoping of framework, boundary and evidence
- Technical assessment
- Control review
- Analysis and severity rating
- Reporting and readout
Not included
- Remediation: We assess. Closing findings is your team or separate scoped work.
- Penetration testing: If you need adversarial testing rather than assessment, we scope that separately.
- Certification: We assess and prepare. Accredited bodies certify.
- Continuous assessment: A point-in-time position, with a stated review horizon.
- AI system testing: AI-specific adversarial testing is a different service and method.
10 / How we do it
A traceable path from scope to evidence.
Scoping
Framework, boundary and evidence requirements agreed in writing before anything starts.
Technical assessment
Vulnerability, configuration and hardening verification across the boundary.
Control review
Design and operating effectiveness, sampled and evidenced.
Analysis and rating
Mapped, rated, false positives removed.
Reporting and readout
Both reports, the sequence, and a session with whoever must act.
Mapped againstISO/IEC 27001NIST Cybersecurity FrameworkCIS ControlsEssential Eight (Australia)PTES
11 / Timeline
3 to 6 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Week 1
Scoping and access
Agree the framework, boundary and evidence requirements in writing, and provision access.
Customer effort
One 60-minute scoping call, plus access provisioning.
Weeks 2 to 3
Technical assessment
Verify vulnerability, configuration and hardening across the boundary.
Customer effort
A technical point of contact for roughly 2 hours a week.
Week 4
Control review and evidence testing
Review control design and sample operating effectiveness.
Customer effort
3-5 interviews of 45 minutes.
Weeks 5 to 6
Analysis, reporting, readout
Map and rate the findings, remove false positives and present both reports. Across the engagement, expect roughly 10-14 hours of your team's time; access provisioning, not the testing, usually sets the pace.
Customer effort
One clarification session and a 60-minute readout.
Our work: 3 to 6 weeks
12 / Scope check
Test whether Security Assessments
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your engagement lead
Steve Sharma
Founder & Principal
Scopes every assessment personally and reviews every finding before it reaches the report.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
Evidence-based, and we say what that means.
We inspect, sample and test. A claimed control and a demonstrated one are reported differently, and the distinction is on this page.
False positives removed before you see the report.
A report you have to triage is a report that costs you a week. Verification is in the method, not an optional extra.
Findings mapped to a framework, not just listed.
So the same report serves your engineers and your auditor without a translation layer.
15 / The boundary
What this engagement does not claim.
Independence
We assess. We do not assess remediation we performed.
Closing findings is your team or separately scoped work, and we never assess work we delivered.
Certification
We prepare organisations. We do not issue certificates.
We prepare organisations for assessment and certification, but we do not certify our own work. Accredited bodies certify.
Operations
We are not a managed security service.
The assessment is a point-in-time position with a stated review horizon, not continuous monitoring.
Frameworks
One assessment, mapped to the framework that answers your question.
ISO/IEC 27001, the NIST Cybersecurity Framework, the CIS Controls, PTES and, for Australian organisations, the Essential Eight.
16 / Client evidence
What this work produces
Government supplier150 to 400 staffAnonymised, permission on file
The challenge
A tender required an independent security assessment within six weeks, and the organisation's existing position was a self-scored spreadsheet nobody was willing to sign.
The approach
More of the work Scope was narrowed in week one to the systems actually in the tender boundary rather than the whole estate, which reduced the cost and met the date.
5weeks
From engagement to a signed independent assessment submitted with the tender. Nine findings, three material, all sequenced with costs attached.
What moves the fee
Environment size, per additional 50 hosts in scope.
Where multiple frameworks are in scope.
Where evidence is already centralised.
A fixed fee for the standard scopeAnything outside the standard scope quoted before it startsFindings report, evidence pack, remediation sequence and executive summaryRemediation excluded
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
A specific framework has already been named for you.
The framework page is more direct and better priced for it.
02
You need adversarial testing rather than assessment.
A penetration test answers a different question, and we scope it separately.
03
You have a recent evidenced assessment.
Bring us the findings instead. We will say honestly whether re-testing is warranted.
20 / FAQ
The questions that change the decision.
A scan produces output. An assessment produces a position: findings verified, false positives removed, mapped to controls, rated for exploitability and sequenced. If a scan is all you need, buy a scan; it costs far less.
Whichever answers your question: ISO 27001, NIST CSF, CIS or, for Australian organisations, the Essential Eight. We agree it at scoping, because assessing against the wrong one produces a report nobody can use.
Yes, before you see the report. A report you have to triage costs you a week, and shipping raw scanner output has never seemed to us like a deliverable.
Some of it, as separate work, and we never assess remediation we performed. Often your own team or a cheaper provider is the right answer and we will say so.
We state a review horizon in the report. For most environments it is six to twelve months, shorter where change is rapid.
21 / Next move
If Security Assessments is what you need, the next step is a conversation about scope.
A 45-minute conversation with Steve Sharma, who would lead the engagement: what your scope looks like, what it involves, and whether this is the right service for you at all.