Security Assessment
Security Assessment
What is a Security Assessment
A security and infrastructure assessment will identify and document key security controls in your IT environment. When your organization performs a security assessment, it allows you to review your technology portfolio from the view of a perspective attacker.
The report will help technology managers make informed decisions on where to allocate resources, what managed security tools they need to invest in, and what additional security controls need to be acquired.
How Does a Security Assessment Work?
Security assessments can range from being a high-level generalized report to an in-depth analysis. Factors that impact the depth of the assessment model include company size, expected growth rate, technology stack, and resources.
Impactful security assessments include the following steps.
Identification. Document all the critical pieces of your technology infrastructure and note how data is stored and transmitted through these resources.
Assessment. After you identify all the critical pieces of your technology infrastructure, you will need to assess how to allocate time and resources toward assessment. This stage is focused on assessing the correlation between your technology assets, threats, and necessary mitigation controls.
Mitigation. Document your mitigation control for each of your critical pieces of technology.
Prevention. Implement the necessary mitigation controls identified to protect your firm’s data and resources.
What Problems does a Security Assessment Solve?
Security assessments are not a one-time project. Our security engineers recommend this to be part of your annual IT assessments. Annual reviews will allow your organization to stay up-to-date on what threats your infrastructure is currently exposed to.
What Industries Require a Security Assessment for Compliance?
Any organization that collects personally identifiable information (PII) or personal health information (PHI) should undergo an annual risk assessment. Information such as social security numbers, passport details, medical history and financial information must be properly stored.
There are a variety of laws, regulations, and standards that dictate what assessment is needed. Some governing bodies include HIPAA, PCI-DSS, the Sarbanes-Oxley Audit Standard 5, and the Federal Information Security Management Act (FISMA).
