The Security Reality Check
Sometimes you just need a straight answer: is your business protected the way you have been told it is? We look at the agreements and records behind the assurances, then explain in plain language what the evidence supports, what needs attention, and what to do next.
- Typical duration
- 1-2 weeks, from records received to walkthrough
- Scope
- 12 domains
- Pricing
- Fixed fee, quoted after free scoping by call or email
What you receive
The report is one document. These are its three main parts; the full report has five sections. Each finding carries a NIST CSF 2.0 reference to make its basis easier to discuss.
Understand your security coverageExecutive findings summary
We explain what the records support, what remains unclear, and which decisions need your attention.
Know who needs to actSecurity confidence scorecard
We bring the ratings, responsibilities, and immediate actions together so you can discuss them with your team.
Set priorities for the next 90 days30/60/90-day roadmap
We give you and your IT team or provider a plan with priorities, an owner for each action, and a way to check progress.
Decisions the report can support
- Whether to renew a provider on the same terms.
- What to show an auditor, an insurer, or a client who asks how their information is protected.
- Which fixes to fund first, and who owns each one.
- What the records support about email protections, payment approvals, and changes to bank or wire instructions.
How the review works
How we reach those conclusions
- AgreementsWhat was promised
- RecordsWhat the evidence supports
- FindingsGaps and responsibilities
- PrioritiesWho acts and what comes first
See the records we request and how we check the evidence.
Scoping
Before work begins we confirm the environment, the providers taking part, the records we will ask for, who attends, and the fee. This happens on the free scoping call, or by email if you prefer, and needs nothing confidential from you.
Evidence assessment
We compare the agreement, the configuration, and the operational records against the twelve domains and record where they do not support the same conclusion. See how we check the evidence.
Walkthrough
We walk you through the findings in plain language and explain the priorities in your roadmap, so you and your team can decide what to do next.
The Security Reality Check is based on supplied records; we do not connect to or change live systems. Any technical testing or implementation belongs in a separate scope with the appropriate provider or specialist. Optional oversight tracks agreed actions and completion evidence; ongoing security leadership is also available. We do not assess work we planned or supported.
Explore the twelve domains
Every Security Reality Check covers all twelve domains. Open any domain to see what we review. These are parts of the full scope, not options to select.
Governance
Whether security decisions, owners, and exceptions are documented and reviewed.
Asset Management
Whether you can identify the devices and systems that need protecting.
Identity & Access
Whether access is limited to the right people and removed when it should be.
Endpoint Security
Whether computers are managed, protected, and supported across their working life.
Network Security
Whether network access and equipment are configured to limit inappropriate connections.
Email Security
Whether email protections reduce spoofing, malicious delivery, and unsafe forwarding.
Vulnerability Management
Whether operating systems and everyday applications are patched within an agreed timeframe.
Monitoring & Detection
Whether important alerts are seen by someone responsible for acting on them.
Incident Response
Whether people know who does what when something goes wrong and how response is recorded.
Vendor Risk
Whether provider responsibilities, access, and assurances are understood before they affect your business.
Security Awareness
Whether people receive practical guidance and the business learns from reported concerns.
Backup & Recovery
Whether copies can be recovered when needed and are protected from deletion.
Why the Reality Check
Built for questions that arrive with a deadline.
Evidence-led by design
We place what was promised beside the configuration and operational records that support it. That gives leadership a practical basis for a decision instead of another general assurance.
Two professional perspectives
Security practice and an attorney's perspective inform how we examine records, responsibilities, and the decisions in front of you. Learn why we built Security Reality Check.
Security questions often arrive with a deadline: a provider renewal, insurance questionnaire, client request, payment change, or important technology decision. The Reality Check gives you a clear record before the answer becomes urgent. Read why a service agreement alone does not prove delivery.
What we need from you
Name a point of contact and arrange participation from the people responsible for the systems in scope. Do not send confidential records with your initial inquiry.
Before the report is final, you and participating providers can correct factual errors or supply relevant records. A missing record is reported as missing, not scored as a failure. How we handle corrections.
Preparing for the Security Reality Check
Identify who holds your service agreements, configuration records, and operational reports. During scoping, we agree the records, participants, and time needed from your team and providers.
Before work starts, we explain how unavailable records or delayed participation affect the schedule and conclusions.
Find out what is actually protecting your business
Tell us what you need help understanding. We reply within two business days. Start with a free 30-minute scoping call, or discuss the scope by email if you prefer.
Talk with us