Framework assessments

Practical guides for consultants and vCISO teams assessing clients against a security framework: what the framework asks for, what evidence to request, and how to reuse that evidence across frameworks.

• CPCSC readiness assessments for consultants

  CPCSC Levels 1, 2 and 3 explained: the 13 Level 1 controls, the evidence that supports them, and how consultants prepare defence suppliers for Level 2.

• Évaluations de préparation au PCCC pour les consultants

  Les niveaux 1, 2 et 3 du PCCC, les 13 contrôles du niveau 1, les éléments probants à demander et la préparation d’un fournisseur de la défense au niveau 2.

• CMMC Level 2 and NIST SP 800-171 assessments for consultants

  How consultants and RPOs run a CMMC Level 2 readiness assessment against NIST SP 800-171, calculate the SPRS score and check eligibility for conditional status.

• ISO 27001 gap assessments for consultants

  How to run an ISO 27001:2022 gap assessment across clauses 4 to 10 and the 93 Annex A controls, what evidence to request and how to deliver a readiness report.

• NIST CSF 2.0 maturity assessments

  How to assess a client against NIST CSF 2.0's six functions, why CSF has no built-in maturity scale, and a 0 to 5 rubric that ties each score to evidence.

• CIS Controls v8.1 assessments for consultants

  How consultants assess clients against the 18 CIS Controls and 153 Safeguards in v8.1, choose an Implementation Group and turn results into a roadmap.

• SOC 2 readiness assessments for consultants

  How to run a SOC 2 readiness assessment for a client, from choosing Trust Services Criteria to testing Type II evidence, and where the CPA firm's role begins.

• How to run a security gap assessment for a client

  How consultants run a security gap assessment or gap analysis for ISO 27001, SOC 2, PCI DSS, CMMC or CPCSC, from scoping and evidence to the remediation plan.

• How to run a cybersecurity maturity assessment for a client

  How consultants score cybersecurity maturity per control from client evidence, which scale to use with NIST CSF, ISO 27001 or CIS, and the mistakes to avoid.

• TPN assessment readiness for media and entertainment vendors

  How consultants prepare media and entertainment vendors for a Trusted Partner Network assessment, what each TPN Shield requires and how to scope it.

• Reusing evidence across ISO 27001, NIST CSF, CIS Controls, SOC 2 and CPCSC

  How one piece of client evidence supports controls in ISO 27001, NIST CSF 2.0, CIS Controls, SOC 2 and CPCSC, with a worked crosswalk and the limits of reuse.