Security maturity. Practical next steps.
Cybersecurity Assessments
Understand where your cybersecurity program stands, which gaps matter most, and what to do next.
Fractional CISO and advisory engagements are scoped through Legion Cyberworks.
The problem addressed
A list of security tools or policies does not tell leadership whether the program is addressing the organization’s most important risks. An assessment connects available evidence with business priorities so investment and improvement decisions have a clear basis.
Who this is for
Organizations building a formal cybersecurity program, reassessing an existing program, or preparing for a period of growth or change. The assessment can also support an established security team that needs an independent view of priorities.
What’s included
- Leadership and stakeholder interviews.
- Review of agreed policies, controls and supporting evidence.
- Maturity assessment against an agreed framework.
- Risk and investment prioritization, followed by an executive findings discussion.
What you receive
- A current-state cybersecurity assessment.
- A prioritized improvement roadmap.
- An executive summary of findings and recommended decisions.
- An action register with proposed owners and sequencing.
How the work progresses
Agree the assessment
Define the business context, systems and program areas in scope, the framework, and the evidence required.
Review and interview
Understand how controls operate through documentation, available evidence and stakeholder discussions.
Prioritize the findings
Connect gaps to business consequences and sequence improvements around risk and available resources.
Brief leadership
Review the findings, roadmap and decisions with the leadership team and agree the next steps.
Relevant experience
I strengthened NCEMC’s statewide cybersecurity program, aligned it to CIS, and developed tailored support for 26 electric cooperatives as they requested assistance. My broader experience across banking, utilities, healthcare and professional services informs how I assess governance, program priorities and leadership reporting.
Scope and timing
3–4 weeks after kickoff and access to agreed evidence. Timing varies with organizational scope and stakeholder availability.
This service delivers the Security Maturity Assessment package. Technical testing is included only if explicitly scoped; the agreed assessment is not a certification or a guarantee of compliance.
Fractional CISO and advisory engagements are scoped through Legion Cyberworks.