Service
Security Readiness
A structured review of the controls buyers, insurers, and questionnaires actually ask about, followed by a written remediation plan ranked by effort and exposure. It exists to replace guesswork when someone outside your company asks how you handle security.
Fit
Best for, and not for
Best for
- Companies preparing a cyber-insurance application or renewal
- Teams answering customer or vendor security questionnaires
- Organizations that want a baseline before choosing security tooling
- Leaders who need a plain-language picture of current exposure
Not for
- Penetration testing or red-team exercises
- Formal audit or certification issuance
- Companies looking for a guarantee that a breach cannot happen
- Buyers whose core need is continuous threat monitoring and response
Symptoms
What it looks like before this work
If several of these are familiar, the problem is structural rather than occasional.
- An insurance application asks questions nobody can answer confidently
- A customer questionnaire is holding a deal
- Multi-factor authentication is partly deployed and nobody knows the gaps
- Backups exist but restores have never been tested
- Admin access was granted years ago and never reviewed
Outcomes
What you have afterward
- A written control baseline with current state per item
- A ranked remediation plan with owner, effort, and sequence
- Consistent answers you can reuse across questionnaires
- A clear separation between quick fixes and structural projects
- A documented view of who has privileged access
Scope
What is included
Identity and access review
Accounts, multi-factor coverage, admin rights, shared credentials, and offboarding completeness.
Device and endpoint baseline
Encryption, patch state, endpoint protection coverage, and unmanaged device exposure.
Data and backup review
Where sensitive data lives, retention habits, backup configuration, and whether restores are verified.
Network and vendor exposure
Remote access paths, external services holding company data, and vendor access review.
Process and response readiness
Documented incident steps, escalation contacts, and employee-facing security expectations.
Process
How the engagement runs
Scoping
We confirm the driver — insurance, questionnaire, or baseline — because it changes what gets reviewed first.
Evidence gathering
Interviews plus configuration review across identity, devices, backup, and network.
Findings review
A working session that walks through current state in plain language, without scoring theater.
Remediation plan
A written, ranked plan separating items you can close this month from projects needing budget.
Optional remediation support
We can carry out the plan, hand it to your internal team, or support your team while they do it.
Boundaries
What this service is not
- This is an assessment and plan, not a penetration test, audit, or certification.
- We do not certify compliance with any framework and do not act as an auditor.
- No assessment can prevent a breach, and we do not present it as prevention.
- Answers we help you prepare are your representations; we do not attest to them on your behalf.
Inputs
What we need from you
Approximate answers are fine at the start. Precision comes during discovery.
- The questionnaire, application, or framework driving the request
- Administrative visibility into identity and email platforms
- A list of business-critical systems and vendors
- Existing backup and endpoint tooling details
- Any prior assessment or remediation history
Pricing
How pricing is handled
Pricing is scoped after the readiness conversation. The variables are employee count, number of locations, device count and standardization, identity platform complexity, coverage expectations, and how much cleanup is needed before steady operation. We do not publish rates for work we have not scoped.
FAQ
Security Readiness questions
Will this satisfy our insurer?+
It gives you documented, consistent answers and a remediation plan. Underwriting decisions remain with the insurer, and we do not promise an outcome or premium result.
How long does it take?+
Timing is scoped during the readiness conversation and depends on employee count, number of locations, and how much documentation already exists.
Do we need Managed IT as well?+
No. Many companies start with readiness only. Ongoing support helps when the remediation plan reveals recurring operational gaps rather than one-time fixes.
Related
Other services
Next step
Start with the assessment
Seven questions, then a recommendation with reasoning. If Security Readiness is not the right starting point for you, the result will say so.