Information assurance.
Independent assessments against CIS Controls, CMMC, NIST, HIPAA, FISMA, and other frameworks. We measure where you stand, document the evidence, and give you a plan to close the gaps.
Frameworks we assess
We work with federal, healthcare, financial, defense, and commercial organizations.
CIS Controls
We are an authorized provider of CIS Controls assessment services. We measure your environment against the Controls and report exactly where you stand.
Request a review →CMMC 2.0
We assess where you stand against CMMC 2.0, plan the work with you, and write the SSP and PoAM you need.
Request a review →NIST
We perform the Assess step of the NIST Risk Management Framework across the 800-series standards.
Request a review →HIPAA
Assessments against the Security and Privacy Rules: risk analysis, safeguard reviews, and a remediation plan.
Request a review →Federal (FISMA, NIST 800-53)
Assessments for regulated environments under IRS 1075, FISMA, NIST 800-53, 800-171, ARC-AMPE, and NIST CSF.
Request a review →NIST AI RMF
Put the NIST AI Risk Management Framework into practice across your AI systems, with the policies, controls, and evidence auditors and customers expect.
Request a review →How an assessment runs
The same five steps on every assessment.
Scope
We agree on the framework, the system boundary, and the evidence we will collect before the assessment starts.
Gather
We review policies and configurations and interview the people who run each control. Everything goes into an evidence repository your team keeps.
Measure
We score each control against the standard and record the evidence behind every score, so the results hold up in an audit.
Report
You get a prioritized list of findings, a remediation roadmap with owners and effort, and a one-page summary for leadership.
Plan
The findings become a plan with owners and dates, ready for your team to work or to carry into a Boot Camp engagement.
What you get
Every assessment includes the following, delivered through your client portal.
Maturity scorecard
Every control rated against the framework, with the evidence behind each score.
Findings register
Each gap with its severity, the controls it affects, and how to close it.
Remediation roadmap
Prioritized actions with owners, effort estimates, and target dates.
SSP and PoAM
System Security Plan and Plan of Action and Milestones, ready for your assessor or auditor.
Evidence repository
Your policies, configurations, and artifacts, organized so your team can reuse them.
Executive summary
One page in plain language for leadership.
Tell us what you are working on.
A senior practitioner will reply within 24 hours with an honest assessment and suggested next steps.