Cyber risk assessment and security gap analysis for businesses
A clear picture of where your business is really exposed, and an orderly plan for what to fix first. No scare tactics and no jargon, in language management understands.
Elad personally accompanies every assessment, from the first conversation to presenting the findings to management.
What is a risk assessment, and what do you get from it?
A risk assessment is an orderly review of your business as it is today: which systems and data you have, who holds access rights, how the network and remote access are built, and whether you can really restore from backup. The goal is not to find as many problems as possible, but to understand which risks truly threaten the business and what to handle first.
At the end you receive a report in business language and a prioritized action plan, with an effort estimate for each step. You can implement it in stages, on your own or with us, at your budget and pace. It is usually also the right starting point before a large security investment or before an ISO 27001 process.
When should you do a risk assessment?
If one of these situations sounds familiar, an assessment is the right first step.
Nobody knows the real state
Systems grew over the years, suppliers changed, and there is no single place that shows what is protected and what is not.
A customer or insurer asked for one
A large customer, a supplier questionnaire or a cyber insurer wants to see that the business has reviewed its risks.
Before investing in security
Before buying another product or service, you want to know what is really worth investing in first.
A review that covers the layers that matter
The assessment focuses on the places where most incidents in businesses begin.
Critical systems and data
Which systems, servers and cloud services you have, what data they hold, and what the business cannot work without.
Microsoft 365 and access rights
Who holds admin rights, whether everyone has MFA, and who shares what outside the organization.
Network, firewall and remote access
How employees connect from outside, which ports are open, and whether the network is segmented properly.
Backups and recovery
Whether there is an isolated backup, when a restore was last tested, and how long it would take to get back to work.
Workstations and servers
Protection for computers and servers, security updates, and local admin rights.
Conversations with key people
Short conversations with management, IT and whoever holds the sensitive data, to understand the processes and not only the technology.
What the assessment looks like
Four stages, with a scope and timeline agreed in advance.
1. Introduction and scope
We learn the business, its systems and the reason for the assessment, and agree in advance on what is checked.
2. Data gathering and checks
Checks on systems, network and backups, and short conversations with key people, without stopping day-to-day work.
3. Analysis and risk rating
Every finding is rated by severity and likelihood, with a practical recommendation next to it.
4. Presentation to management
A meeting where we go through the findings and the action plan, and answer every question.
What stays with you at the end
All deliverables belong to you, written so that non-technical readers understand them too.
- A findings report in business language, explaining what each finding means for the business.
- A risk rating by severity, so it is clear what is urgent and what can wait.
- A prioritized action plan, with an effort estimate for each step.
- A presentation meeting with management and a written summary you can pass on to your IT provider, customer or insurer.
The experience behind the assessment
Elad Elimelech, founder of Marom Cyber, brings 20 years of technology experience, most of them in management roles. In recent years he led technology strategy in information security and management at companies serving hundreds of organizations in high tech, finance and healthcare. He defined information security standards at the highest level and was the go-to authority for the most complex technology challenges across those organizations. When standard solutions were not enough, he led the solution.
Personal support
You work directly with Elad, from the first conversation to presenting the findings. One person who knows your business, not a rotating account manager.
In business language
No scare tactics and no jargon. Every finding is explained in terms of what it means for the business and what to do about it.
Prioritized by risk
Not every finding is urgent. We start with what truly threatens the business and leave what can wait for the next stage.
You decide what comes next
You can implement the plan yourself, with your IT provider or with us. The assessment does not commit you to further work.
Frequently asked questions about risk assessments
If anything is unclear, you can always ask us directly.
Completing the picture
Services and articles that connect to the assessment.
ISO 27001 certification support
A risk assessment is also the first step toward certification. This is what full support looks like.
Learn more →What a risk assessment reveals
An article on the gaps a professional assessment uncovers: in technology, people, suppliers and processes.
Read the article →Penetration test or risk assessment?
Two different checks for two different questions, and when you need both.
Read the article →Want to know where you stand?
In a short introductory call with Elad we will understand the situation, the reason for the assessment and the right scope. Free and with no obligation.
Book a call →