Cybersecurity
Security Assessments
Prioritized findings against the NIST Cybersecurity Framework and CIS Controls.
What this covers
An assessment tells an agency where it stands and what to fix first. HQT assesses against the NIST Cybersecurity Framework and the CIS Critical Security Controls, adding sector-specific requirements such as CJIS or HIPAA where they apply.
Typical activities
- Interviews with IT, security, and business staff
- Review of policies, architecture, configurations, and prior audit findings
- Technical validation including vulnerability scanning and configuration review
- Scoring by framework function and control, with a maturity rating
- A prioritized roadmap with effort and impact estimates
What you receive
An executive summary suitable for a council or board, a detailed findings report, a scored control matrix, and a roadmap that sequences remediation.
Considerations for public agencies
Assessment results may be subject to public records requests. We structure reports so that sensitive technical details can be withheld under applicable exemptions while the summary remains shareable.
When an assessment is the right next step
An assessment is usually timed to a change that no one has yet looked at as a whole: a cloud migration, a new ERP or a new CAD and records system, an IT consolidation, or a permanent move to hybrid work. A second trigger is that basic questions take days to answer. If an auditor, an insurer, or a council member asks how many privileged accounts exist, or whether multi-factor authentication covers remote administrative access, and staff have to reconstruct the answer, the underlying inventory and control documentation are missing. A third is an attestation coming due, since insurance renewals, grant applications, and state reporting often ask an agency to affirm specific controls.
The counter-signal is worth stating. If the agency already holds a current and credible list of gaps, and the constraint is funding or staff time, another report will not move anything. Spend the money on remediation instead.
Judging the quality of an assessment
Ask what evidence sits behind a finding. A finding traceable to a configuration export, a log sample, a scan result, a policy section, or a dated interview can be argued with and acted on; one that is not is an opinion. Ask how severity was set, because tool severity describes a generic environment rather than which systems this agency actually depends on. A report in which nearly every finding is critical has not prioritized anything. Ask for the written criteria behind any maturity score, since scores without a published rubric cannot be compared against next year's.
The recurring weak spots are easy to test for. Ask whether the work reaches the places agency data actually sits: hosted line-of-business applications, a managed service provider's administrative access, and operational technology in utilities and public works. Ask whether recommendations say what to change in this environment rather than quoting the framework back. Ask whether the assessor earns revenue on anything it is likely to recommend, and settle that question before award rather than after.
Scope and terms worth setting in the solicitation
- Name scope in nouns: sites, domains, network ranges, cloud tenants, hosted applications, and which operational technology is in or out. Loose scope here tends to surface later as change orders.
- State which standards apply and at what depth: the NIST Cybersecurity Framework, whose current version organizes outcomes under Govern, Identify, Protect, Detect, Respond, and Recover; the CIS Critical Security Controls at a stated Implementation Group; and any CJIS Security Policy or HIPAA Security Rule obligations covering systems in scope.
- Ask for the scoring rubric, and for the control matrix in a format the agency can maintain itself afterward.
- Set rules of engagement for technical testing: scan windows, excluded systems, rate limits, and a named agency contact who can stop a scan.
- Specify how findings and scan data are stored, encrypted, retained, and returned or destroyed at closeout, since that material is a target in its own right.
- Decide before release whether the assessor may bid the remediation work, and put the answer in the document.
Checking that the assessment changed something
Set the checkpoints at kickoff rather than after delivery. The first is ownership: every high-priority finding should have a named owner and a target date by the time the report is accepted. If that does not happen, the report did not land, whatever its technical quality.
After that, track closure by priority tier rather than by raw count, because clearing easy low-tier items while the top tier sits untouched reads as progress and is not. Verify a sample of closed findings instead of accepting an assertion of closure. Watch the operating indicators the roadmap should be moving: multi-factor coverage on privileged and remote access, time to patch internet-facing systems, endpoint detection coverage, and the last tested restore from backup. Re-score against the same rubric on a set interval. If the next assessment returns the same findings in new wording, the problem sits in the remediation program, not the assessment.
Working with HQT on this
HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.
Frequently asked questions
What is the difference between a security assessment and a penetration test?
An assessment measures breadth against a framework: governance, policy, identity, logging, backup, vendor management, and the configurations behind them. A penetration test measures depth against a defined target by attempting to exploit specific weaknesses. An agency that has not been assessed before usually gets more out of the assessment first, since a penetration test often confirms gaps that a control review would have surfaced with less effort. The two fit together once a baseline exists.
Should we assess against the NIST Cybersecurity Framework or the CIS Controls?
They answer different questions, so agencies often use both. The current version of the NIST Cybersecurity Framework organizes security outcomes under Govern, Identify, Protect, Detect, Respond, and Recover, which gives executives and elected officials a structure they can follow. The CIS Critical Security Controls describe concrete safeguards grouped into Implementation Groups, which makes them easier to turn into assigned work. A common approach is to use the framework for the narrative and the controls for the task list.
Will a security assessment disrupt our production systems?
Interviews, document review, and read-only configuration review have no operational effect. Credentialed and network scanning does add load, so scans against sensitive systems, including SCADA and other operational technology, should be scheduled, rate-limited, or replaced with passive review. Agree on rules of engagement, a testing window, and a named agency contact who can halt a scan before any technical activity starts.
Can a security assessment support a grant application or a cyber insurance renewal?
Often yes, though it depends on the program. Grant programs that fund local government cybersecurity have generally expected applicants to show that risks were identified and prioritized, which is what framework scoring and a sequenced roadmap document. Insurance applications ask control-by-control questions, and a current control matrix lets staff answer from evidence rather than recollection. Requirements and funding change between cycles, so confirm what the specific program asks for in the year you apply.
How much of our own staff time does a security assessment require?
The agency supplies access, documents, and answers, and that is the bulk of its effort. Plan for interview time from IT, from security staff where that role exists, and from the business owners of major systems, plus someone to pull together policies, network diagrams, asset inventories, prior audit findings, and vendor agreements. Naming one internal coordinator with authority to schedule interviews and chase documents tends to be what keeps the schedule from slipping.