Security Risk Assessment
A security risk assessment tailored to your objectives, size, and industry. We identify what could go wrong, how likely it is, what it would cost, and what to do about it.
More than a checklist: a clear picture of your risk.
Eagle consultants have years of experience assessing information security risk for healthcare providers, government agencies, financial services firms, and other regulated organizations. Our assessment protocol is tailored to your objectives as well as the size, scale, and type of your organization.
The assessment looks beyond technical controls. We learn your key business processes, your finances, and existing risk safeguards such as cyber-liability coverage, so we can evaluate the right controls and show decision makers where the real exposure is.
Eagle recommends the FAIR (Factor Analysis of Information Risk) methodology, the international standard quantitative model for information security and operational risk. FAIR produces quantitative forecasts of risk based on the probability of security failures and estimates of financial loss. For clients who need it, including federal agencies, we also perform assessments using NIST SP 800-30.
Our risk assessment will include:
- What could go wrong
- What the organization is doing to prevent those failures
- The probability that a bad event will occur
- The losses if it does occur, in dollars
- Recommendations to reduce risk
Everything you need to understand and act on your risk.
Control evaluation
Itemized review of the controls required by your chosen framework and regulations, with the effectiveness of each implementation.
Financial impact analysis
Estimates of the financial and reputational impact of likely security failures, presented in terms that fit your organization.
Cyber insurance review
A review of any cyber-liability coverage in place, with any gaps between your coverage and your risks.
Security testing (optional)
Vulnerability scanning, penetration testing, or application reviews can be added to the engagement.
Physical site review
A walk-through of all facilities, or a representative sample, to evaluate physical security controls.
Executive-ready report
A final written report aligned to your regulatory requirements, with an executive summary of top findings.
A structured, four-phase engagement.
Discovery
We send a discovery request for policies, insurance information, third parties, applications and data sets, asset inventory, and recent test results.
Validation and testing
Interviews with technical staff, system owners, management, and support vendors, plus a review of previous security tests.
Site review
If in scope, a walk-through of facilities to evaluate physical security controls.
Final report
Documented findings, control effectiveness, and risk estimates: qualitative with NIST SP 800-30, or quantitative with FAIR and Monte Carlo simulation.
“Very efficient and timely. I’m extremely satisfied with your services.”
Robin, West VirginiaOften paired with
vCISO Services
Security leadership on demand: strategy, risk management, questionnaires, and board reporting.
Learn more →Penetration Testing
Controlled attacks against your network and applications to prove what is exploitable.
Learn more →HIPAA Policies and Procedures Development
HIPAA Privacy and Security policies built from proven templates and tailored to you.
Learn more →Get ahead of your next assessment or audit.
Tell us about your organization and the frameworks you answer to. We will follow up to talk through where you stand and what to tackle first.
Schedule a consultation