Document your security risks
Give leadership, insurers, and customers a current assessment of the risks affecting your organization, with clear evidence and scope limitations.
Cybersecurity risk assessment.
We review the systems, data, people, vendors, and controls in your agreed scope using NIST CSF and CIS Controls. You receive evidence-backed findings, a scored risk register, and a prioritized remediation roadmap.
Flagship
ASSESSMENT
The full cybersecurity risk assessment
- 2–4 weeksTypical delivery window
- One scopeAgreed before kickoff
- One advisorFrom kickoff through findings
- Written outputReport, register, and roadmap
When to use this service.
Prioritize technical findings
We evaluate weaknesses alongside threats, business impact, and existing safeguards so your team can prioritize work beyond a list of scan results.
Plan remediation and budget
Use the findings to assign owners, estimate remediation effort, and sequence improvements against the risks they address.
Best fit: regulated small and midsize organizations with an IT team or MSP, multiple systems or vendors, and a board, insurer, customer, or compliance deadline asking for documented risk decisions.
Not the right fit: organizations seeking a checkbox certification, an emergency incident-response team, or penetration testing without a broader risk assessment.
Our process.
-
Step 01
Confirm scope and fees
A free 30-minute call identifies systems, locations, vendors, and applicable requirements. The scope, assessment activities, deliverables, and fixed fee are agreed before kickoff.
-
Step 02
Review systems and evidence
We combine asset and data-flow review, authorized scanning where appropriate, interviews, and control evidence. Timing and staff involvement depend on scope; the typical delivery window is two to four weeks.
-
Step 03
Deliver the risk register and roadmap
We explain findings and priorities to leadership and IT, then deliver the risk register and 30/60/90-day remediation roadmap. Implementation and ongoing advisory support are separately scoped.
Client reviews.
Aprio
The assessment brought up the right uncomfortable questions around access, client data, and old accounts. The consultants at Hardenwell handled it professionally and helped us separate urgent work from cleanup work.
Stewart Title / Stewart Information Services
The hard part was not finding things to improve. It was knowing which improvements mattered most. Our Hardenwell advisor helped weigh risk, effort, and business impact so the plan felt practical.
Behavioral Health Group
The challenge was deciding what to do first across a busy care environment. The team pressure-tested access controls, remote-work exposure, and vendor dependencies, then kept the plan realistic enough for the technical team to execute.
Frequently asked questions.
Pricing reflects the systems, locations, headcount, complexity, and modules in scope. The fee and deliverables are fixed in writing before work begins. Additional work requires an approved scope change.
NIST CSF organizes cybersecurity outcomes and CIS Controls supports the safeguards review. A HIPAA module or insurance-questionnaire review can be included when agreed in scope. These additions do not turn the assessment into a certification or an insurance coverage opinion.
We agree scan permissions, testing windows, and interviews with your team. Technical checks can carry operational risk, so sensitive systems, exclusions, and escalation contacts are documented before scanning. Staff time depends on the environment and evidence available.
Your team receives a findings walkthrough and a remediation roadmap with owners and priorities. IT or your MSP can implement the work. Hardenwell can provide separately scoped remediation oversight or Fractional CISO support; neither is required to receive the assessment.
Why Hardenwell.
A dedicated advisor
A named, CISSP-certified advisor leads your engagement, with specialist support where needed. Responsibilities and the agreed deliverables are documented before work begins.
No referral commissions
We do not receive referral commissions from auditors, testing firms, brokers, or software vendors. External services are identified separately so you can review their scope and fees.
A written remediation plan
Everything we write is simple enough for leadership to approve and specific enough for your IT team or MSP to implement. One document, both audiences.
Book your scope call.
Thirty minutes with an advisor.
We’ll cover your organization, systems, deadline, and the evidence already available. You’ll leave knowing the likely scope, timing, and next step.
Prefer phone or email?
(754) 216-9664 info@hardenwell.com
Do not include PHI or sensitive records in booking notes. See our Privacy Policy.