Skip to content
Contact us

What is a non-technical cyber security assessment?

What is it?

A non-technical cyber assessment is an evaluation of an organization's cybersecurity posture that does not involve detailed technical analysis or testing. Instead, it focuses on the organization's policies, procedures, and controls related to information security.

This type of assessment typically includes a review of the organization's security policies, training and awareness programs, risk management processes, incident response procedures, and third-party risk management practices. It may also include interviews with key personnel to assess their understanding of cybersecurity risks and their role in protecting the organization's assets.

Overall, a non-technical cyber assessment is designed to provide a high-level view of an organization's cybersecurity posture and identify areas for improvement. It is often used as a first step in developing a comprehensive cybersecurity program or as a periodic check to ensure ongoing compliance with industry standards and best practices.

Who is it for?

A non-technical cyber assessment based on the CIS (Center for Internet Security) or NIST (National Institute of Standards and Technology) frameworks is typically conducted for any organization that wants to assess its cybersecurity posture against industry-recognized standards.

Both the CIS and NIST frameworks provide guidelines for managing and mitigating cybersecurity risks, and are widely used by organizations of all sizes and in various industries. The CIS Controls, for example, are a set of 20 prioritized actions that organizations can take to improve their cybersecurity posture, while the NIST Cybersecurity Framework provides a framework for identifying, assessing, and managing cybersecurity risks.

A non-technical cyber assessment based on these frameworks is designed to provide a high-level view of an organization's cybersecurity posture and identify areas for improvement. It can be conducted by internal auditors or third-party consultants who specialize in cybersecurity risk management.

The assessment is typically conducted for the benefit of the organization's leadership, including executives, board members, and other stakeholders. It provides them with an understanding of the organization's cybersecurity posture and helps them identify areas where additional investment in cybersecurity measures may be required. The assessment report can also be used to communicate the organization's cybersecurity posture to external stakeholders, such as customers, vendors, and investors.

How do I get it?

There are several options for getting a non-technical cyber assessment for your organization:

  1. Internal auditors: If your organization has an internal audit department, they may be able to conduct a non-technical cyber assessment. However, it's important to ensure that the auditors have the necessary expertise and training in cybersecurity risk management.

  2. Third-party consultants: Many consulting firms specialize in cybersecurity risk management and can conduct a non-technical cyber assessment for your organization. It's important to ensure that the consultants are qualified and have experience in conducting assessments based on the frameworks that you are interested in.

  3. Industry associations: Some industry associations may offer non-technical cyber assessments as part of their membership benefits. This can be a cost-effective option, but it's important to ensure that the assessment meets your organization's specific needs.

  4. Government agencies: In some cases, government agencies may offer non-technical cyber assessments to organizations in certain industries. For example, the Department of Homeland Security offers free cyber assessments to organizations in the healthcare and public health sectors.

Regardless of the option you choose, it's important to ensure that the assessment is conducted by qualified professionals and meets your organization's specific needs.
, , ,

Blog comments