Where you are vs. where you should be. In plain English.
Most firms don't have a clear picture of how their technology compares to peers, what industry standards expect, or where the next material risk sits. We deliver structured gap assessments — security, IT operations, compliance, cloud, app dev — that tell you what's good, what's not, and what to fix in what order.
Why most firms don't know their gaps.
Auditor is coming in 6 months.
Nobody knows what's ready and what isn't. Going in blind.
Insurer just raised the rate by 30%.
Underwriting questionnaire flagged things we didn't even know were issues.
New CFO asks 'how does our IT spend compare to peers?'
Nobody knows. No benchmark, no answer.
Acquired a firm. Now what?
Two stacks, two postures, no clear path to combined state.
What's in the report.
- 01
Current-state map
Where you actually are today. Systems, controls, costs, gaps. Not aspirational — observed.
- 02
Peer benchmark
How your posture compares to similar-sized firms in your industry. Concrete numbers.
- 03
Standard mapping
Mapped to the framework that matters to your firm: NIST CSF, ISO 27001, HIPAA, SOC 2, ITIL.
- 04
Risk register
Each gap rated by likelihood and impact. Prioritized for remediation.
- 05
Remediation roadmap
12-month plan to close the top gaps. Costed. Sequenced. With owners.
- 06
Executive readout
Board-ready slide deck plus written summary. We present in person or via Teams.
Areas we assess.
Most clients do one or two of these. Some do all five.
| Topic | What we look at | Standard duration | |
|---|---|---|---|
| Security posture | Identity, endpoints, network, cloud, awareness | — | 3 weeks |
| IT operations | Monitoring, patching, backup, asset, vendor | — | 3 weeks |
| Compliance readiness | SOC 2, HIPAA, ISO 27001, PCI | — | 4 weeks |
| Cloud architecture | AWS / Azure / GCP / M365 design + cost | — | 3 weeks |
| App-dev maturity | Engineering practices, code quality, release process | — | 3 weeks |
The 30-day gap assessment.
- Week 1
Discovery + access
Interviews, document review, read-only access to systems. Scope confirmed.
- Week 2
Deep dive
Findings collected by area. Technical scans where applicable. Peer benchmarks pulled.
- Week 3
Analysis + draft
Risk register populated. Gaps prioritized. Remediation roadmap drafted.
- Week 4
Readout
Executive presentation. Written report delivered. Board-ready deck. Q&A.
What gap assessments typically surface.
Average. Spread across critical, high, medium, low.
Issues that warrant immediate action. Most firms have a few.
To close the top gaps. Paced for realistic adoption.
Reports map to whichever framework you'll be audited on next.
“We were told our IT was 'fine.' Senator's gap assessment found 4 critical issues — including a backup setup that hadn't worked in 11 months. The CFO realized the cost of not knowing was much higher than the assessment fee.”
Who needs this.
- Firms preparing for an audit (SOC 2, HIPAA, ISO, cyber insurance underwriting).
- New CIOs or CTOs wanting an honest baseline of what they've inherited.
- Boards wanting independent assurance about technology risk.
- Acquirers wanting to standardize across acquired firms.
Q01Is this the same as an audit?
Is this the same as an audit?
No — gap assessments are advisory, not certifying. We tell you the truth; we don't issue a report you can hand to a third party. Most clients do this before pursuing actual certification.
Q02Will you find things our team didn't already know?
Will you find things our team didn't already know?
Almost always. External eyes catch what internal habit normalizes. Our worst engagement found 47 issues; our best found 12.
Q03Do you fix the findings too?
Do you fix the findings too?
Optional. Many clients have us scope and run the remediation. Others use the report to direct their own team or another partner.
Q04Can we do just one area, not all five?
Can we do just one area, not all five?
Yes. Most clients start with one (usually security or compliance). Some come back for others later.
Free 60-min scoping call.
Tell us where you're concerned. We'll propose which gap assessment fits, what the fixed fee is, and what you'd see in 30 days.