Know where your security stands — and exactly what to do next.
A senior-led cybersecurity maturity assessment that tells you where your program is strong, where it is exposed, and how you compare to peers of your size. You walk away with a prioritized 12-month roadmap built around your business — not a generic best-practice checklist. Every plan is customized to your company's size, stage, and the threats you actually face.
The "are we secure enough?" problem
Most leadership teams have no honest answer to the question "are we secure?" They have a stack of tools, a managed service provider, an annual scan, maybe a SOC 2 report — and a quiet feeling that none of that is the same thing as knowing. Boards ask. Auditors ask. Customers ask. The answer that builds trust is not "we have an EDR." It is "we know exactly where we stand, here is our plan, and here is the progress against it."
A maturity assessment is the fastest way to get to that answer. We score your program against the same frameworks your auditors and customers use (NIST CSF 2.0, CIS Controls v8), benchmark you against companies your size, and give you a written, prioritized plan to close the gaps that actually matter. The plan is right-sized — a 40-person SaaS does not need the same controls as a 4,000-person hospital, and we never recommend enterprise overhead to a company that does not need it.
Signs you need this
- Your board, investors, or executive team are asking how mature your security program is
- You are pursuing SOC 2, HIPAA, ISO 27001, CMMC, or PCI and want a gap analysis before the audit
- You have inherited a security program and need to know what is actually in place
- You are growing fast and your controls have not kept up with your headcount or revenue
- You are about to be acquired, or you are acquiring, and need diligence-grade clarity
- Cyber insurance renewal is coming and you want to answer the questionnaire with confidence
- You spent on tools but cannot tell whether the money is making you more secure
What the assessment delivers
Four deliverables, every engagement, written for two audiences: the leaders who need a defensible answer and the engineers who need a clear backlog. The work is grounded in the same frameworks your customers and auditors care about, with a benchmark layer so you can answer "how do we compare?" honestly.
Maturity scoring against the right frameworks
- NIST CSF 2.0 across the six functions — Govern, Identify, Protect, Detect, Respond, Recover
- CIS Controls v8 mapped to your size and Implementation Group (IG1, IG2, or IG3)
- Optional overlays for SOC 2, HIPAA, ISO 27001, PCI-DSS, or CMMC if you are pursuing one
- Current-state score, target-state score, and the gap between them — per control, not just per category
Peer benchmarking
- Where your program lands relative to companies of similar size, industry, and risk profile
- Honest comparison — not a marketing chart. You see where you lead and where you trail.
- Useful for board reporting, investor updates, M&A diligence, and cyber insurance conversations
- Drawn from anonymized engagement data and published industry sources
A 12-month roadmap built for your size and stage
- Prioritized list of initiatives — what to fix in the next 30 days, 90 days, and 12 months
- Each initiative scoped with effort, dependencies, expected risk reduction, and rough cost
- Right-sized to your company — no enterprise process forced onto a 40-person team
- Adjusts as you grow — explicit triggers for when to add a control as headcount or revenue increases
Executive readout and written report
- Written report with executive summary, scoring, benchmark, roadmap, and an evidence appendix
- Live 60-minute readout with your leadership team — questions answered, decisions captured
- Board-ready slides on request — clean, defensible, no jargon
- Shareable with auditors, customers, insurers, and acquirers under NDA
How the assessment runs
A four-phase engagement that respects your team's time. Most assessments complete in 3 to 5 weeks from kickoff to readout. You get a written statement of work with a fixed fee before any work begins. We come to the engagement with a structured interview guide and a short evidence list — you do not have to figure out what to send us.
The four phases
- Scoping & kickoff. 30-minute discovery call, then a written SOW with fixed fee. We agree on frameworks, scope, stakeholder list, and timeline. No surprises.
- Discovery. Structured interviews with the right people across security, IT, engineering, HR, and leadership. Documentation review. Light technical walkthrough of how key controls actually run today. Typically 2 to 3 weeks.
- Analysis & benchmarking. Scoring against NIST CSF 2.0 and CIS Controls, peer comparison, and a prioritized roadmap drafted against your size and stage. We pressure-test the priorities with you before the readout.
- Readout & report. Live executive readout, written report, board slides on request. Optional 30-day check-in to help you stand up the roadmap inside your team.
What we ask of you
- One internal sponsor — usually CEO, CTO, CISO, or COO — who can make decisions and unblock access
- Time on calendar for 6 to 12 structured interviews (45 to 60 minutes each) across the right roles
- Read-only access to documentation we ask for: policies, network diagrams, vendor list, prior reports
- Honesty about what is broken or skipped — confidential to us, and the single biggest predictor of useful output
Every plan is right-sized to your company
A 30-person SaaS startup and a 3,000-person regional health system both need a security program. They do not need the same one. We customize every roadmap to the company's actual size, stage, industry, and risk — so the plan is something your team can realistically execute, not a wishlist of enterprise controls borrowed from a template.
What we customize, every engagement
- Framework depth. CIS IG1 for early-stage, IG2 for growing mid-market, IG3 for regulated or larger orgs. We pick the tier that matches you today and tell you when it is time to step up.
- Control selection. A 40-person company does not need a 24/7 SOC. A 400-person company may. We tell you which controls are non-negotiable now and which can wait until you triple in size.
- Build vs. buy vs. outsource. The right answer changes with headcount and revenue. We recommend the option that fits your stage today, with a clear trigger for when to revisit.
- Investment pacing. The roadmap is sequenced so each quarter is fundable and demonstrable, not a single massive lift.
- Industry overlays. Healthcare, fintech, defense, education, and SaaS all carry different obligations. We bake those in instead of bolting them on.
Designed to grow with you
- Explicit "next stage" triggers — when to add SSO, MDR, a SOC, a DPO, a Fractional CISO, full-time CISO, or a dedicated AppSec program
- A re-baseline path — most clients re-run a lightweight maturity check 12 months later so the roadmap stays alive
- Pairs with our Fractional CISO retainer if you want help executing the plan after the readout
Why a Red Hound assessment
Most assessments are done by a generalist consultant with a template. The output looks the same regardless of whether you are a 40-person SaaS or a 4,000-person hospital — which is the giveaway that it was not actually about you. Our team has spent two decades inside Fortune 500 programs and offensive practices, and we bring that practitioner depth to companies that usually cannot afford it.
What makes us different
- Senior assessors. The work is done by operators with a decade or more of program experience, not first-year consultants.
- Offensive-aware. Our team also runs the pen tests. We know which "medium" findings in a maturity scorecard turn into real compromise — and we score accordingly.
- Buyer-side experience. We have sat across the table from hundreds of vendor security reviews. We know exactly what your customers and auditors will look for.
- Vendor-neutral. No reseller commissions, no "preferred stack" pressure. We recommend the tooling and providers that fit your size and stage, period.
- Right-sized always. We refuse to recommend enterprise controls to companies that do not need them. The plan is something you can actually execute.
- Optional execution help. When you need a partner to actually run the roadmap, our Fractional CISO retainer picks up where the assessment ends.
Frequently asked
The questions every leader asks before committing to a maturity assessment. If yours is not here, ask it on the call.
How long does the assessment take?
Most engagements complete in 3 to 5 weeks from kickoff to readout, depending on company size and stakeholder availability. You will have a firm timeline in the written SOW before any work begins.
How much time does my team need to commit?
Plan on 6 to 12 structured interviews (45 to 60 minutes each) across the right roles — typically a mix of security, IT, engineering, HR, legal, finance, and an executive sponsor. We come with a focused interview guide so the time is well-spent. Beyond interviews, we ask for documentation review access; you do not have to assemble anything from scratch.
Which framework do you use?
The default is NIST CSF 2.0 plus CIS Controls v8 — together they cover what most boards, auditors, customers, and insurers expect to see. If you are pursuing SOC 2, HIPAA, ISO 27001, PCI-DSS, or CMMC, we add that as an overlay so the same engagement gives you the gap analysis you need for the audit.
How is the peer benchmark calculated?
We combine anonymized engagement data from companies of similar size and industry with published industry research. The benchmark is a comparative view — where you tend to lead, where you tend to trail, and where you sit at the median. We are explicit about the methodology in the report so it is defensible in front of a board or an acquirer.
What does it cost?
Fixed-fee, scoped on the discovery call. Cost depends on company size, framework breadth, and any compliance overlays. Most SMB and mid-market engagements land in a range your CFO will recognize as proportional to the value. You see the number in writing before you sign anything.
Can I share the report with my board, customers, or insurer?
Yes. The report is structured for external sharing: executive summary, scoring, benchmark, and roadmap are appropriate for boards and procurement under NDA. We also produce board-ready slides on request. Many of our clients use the report as their narrative for cyber insurance renewals and customer trust conversations.
Do you help execute the roadmap after the assessment?
Optionally, yes. Many clients pair the assessment with our Fractional CISO retainer so the same team that wrote the plan helps execute it. There is no obligation — the assessment stands on its own and the plan is yours to run with however you like.
Find out where your security really stands.
A 30-minute discovery call, no obligation. We listen, ask hard questions, and tell you honestly whether a maturity assessment is the right next step for your company.