Gap Assessment
Compliance and Regulatory
Guidance
What is a Gap Assessment?
Gap Assessments are an in-depth review that helps organizations determine where they stand currently with information security measured against specific industry requirements. Gap Assessments reduce risk and lead to compliance.
A simple, yet powerful and efficient process
At Security Ideals, we work tirelessly to quantify and reduce risk for our clients. Our process is anchored on accurate risk assessment and skillful project management. Schedule a discovery call to meet one of our vCISOs today!
Get in touch01. Staff Interviews
Interviewing employees who are responsible for specific operational roles is very important. Understanding the processes and procedures your staff use to complete security and business functions informs our gap assessment report.
02. Evidence Review
Our Security experts review the documents and information gathered from the staff interview meetings and highlights inconsistencies.
03. Compliance Roadmap
Once evidence has been evaluated, our security experts will highlight the largest areas of concern and build a roadmap to remediate any gaps. Compliance roadmaps contain timelines, average costs, and suggested products.
Our Bulletproof Process
Our security experts will work with you to build a security roadmap with compliance and security milestones.
1. Kick-Off Meeting
We start with a high-level overview of your company’s current information security program. This initial meeting is designed to connect you with the Security Ideals’ Team as well as introduce our Risk Assessment Framework.
2. Security Analysis
We will complete the Risk Assessment and Security Review Framework through collaborative meetings with our security experts and your company’s stakeholders. The completed Risk Assessment and Security Review establishes the baseline for your security program.
3. Security Strategy
Now that your Risk Assessment and Security Review are complete, our vCISO will present you with the findings and your custom information security strategy for the next 12-months. Based on the security strategy presented in step 3, your dedicated vCISO will begin to tackle the highest risks in your organization. Regularly occurring meetings will be scheduled with your team to review progress and next steps.
Compliance Standards
Security Ideals performs gap assessments against a variety of security frameworks, compliance audits, certifications, and published standards.
SOC 2
- Service Organization Control 2 reports on various organizational controls related to security, availability, processing integrity, confidentiality or privacy.
- SOC 2 Type 1 and Type 2
- Audit Preparedness Report
HIPAA
- Health Insurance Portability and Accountability Act is a federal law that requires the protection of sensitive patient health information from being disclosed without the patient’s consent or knowledge.
- Legal Compliance
- HITECH
ISO 27001
- ISO 270O1 is the international standard that provides the specification for an Information Security Management System (ISMS).
- ISO 9001 (quality management)
- Certification Readiness Report
CIS v8
- Center for Internet Security benchmarks are internationally recognized as security standards for defending IT systems and data against cyberattacks.
- Implementation Groups 1, 2, and 3
- Security Ideals is a CIS partner
NIST
- The National Institute of Standards and Technology Cybersecurity Framework established a set of information security standards along with guidelines for operators of critical infrastructure.
- 800-171, 800-53, Cyber Security Framework, FedRAMP
NYDFS
- The NYDFS Cybersecurity Regulation is a set of regulations from the New York Department of Financial Services that places cybersecurity requirements on financial institutions.
- Required to operate a bank, insurance company, or other regulated financial institution in New York State.
- Legal Requirement
CCPA
- The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law.
- Required to operate in the State of California
- Legal Compliance
GDPR
- The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in the European Union (EU).
- Privacy Laws
- Certified Information Privacy Officers
GLBA Safeguards
- The Gramm-Leach-Bliley Act requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data.
- Compliance Roadmap
Get in touch with our team today!
Our Security Team is available to answer any questions you may have.
