Good preparation makes the difference
An assessment gives you insight into your risks and priorities. The better you prepare, the smoother it goes and the more useful the result. This checklist will help you get started.
1. Goal and framework
- Why are you having the assessment done? For example because of customer requirements, legislation or a request from management.
- Which framework do you want to be measured against, such as ISO/IEC 27001, NIS2 or the CyberFundamentals?
- Which entities, locations and systems are in scope?
2. The right people
- A single point of contact who keeps the planning on track.
- Someone from management who can confirm the priorities.
- Your IT manager or IT partner, for technical questions and access.
- Where relevant, HR, the data protection officer and the owners of critical processes.
3. Existing documentation
- Existing policies and procedures, even if they are out of date.
- An overview of systems, applications and suppliers.
- A network diagram and any previous audit or scan reports.
- An overview of recent incidents.
Something missing? No problem. Missing information is also a finding, and it is clearly noted in the report.
4. Access and planning
- Agree in advance how the technical assessment will be carried out: with read access, exports or a guided session with your administrator.
- Schedule scans with your IT team or IT partner, within an agreed test window.
- Block time in people’s diaries for the interviews.
What you can expect
After the assessment, you receive a report with findings and risks, plus a roadmap with priorities and an owner for each action. We report critical findings straight away, not just at the final presentation. On the Cyberwise Baseline page, you can read how this works at Cyberwise.