B4 Cybersecurity Risk Assessment for Non-Techies

The techno mumbo jumbo around cybersecurity can be intimidating at best, and cybersecurity vendors like to use scare tactics to get you to buy their products—which often have significant costs. How do you make the decision on who to believe and what to buy?

This assessment, designed for non-techies, can help you find the answers. Our team will help look at your current cybersecurity protections (we’ll talk directly to your IT team to get the information), and then talk you through a non-technical risk scorecard to help you understand where you are compared to some of the industry best practices and professional standards.

Compared to vendor-driven assessments, which are designed to help sell you products or services, our risk assessment is vendor agnostic and leverages our technical expertise combined with our non-technical expertise in business risk management to help you understand where there is residual risk to your organization and what options you have to mitigate those risks (including costs).

To do this, we have classified the safeguards in each risk area into four levels:

• Below Basic = Your organization is a high risk, including the risk of non-compliance with standards (which may have gross negligence and litigation risks).
• Basic = Your organization has implemented the minimum levels of safeguards, but still has some residual risk. Sometimes basic is okay if the area doesn’t have a lot of private information. This is a business risk that we help you understand and assess.
• Better = Your organization has implemented some of the best practices in this area. There may still be some gaps between what you’ve done and the leading practices in the area, but whether you need to be at the best level depends on your level of risk tolerance.
• Best = Your organization has implemented the leading practices or solutions for this year and your risk should be mitigated quite a bit. Kudos to you for being so proactive!

We also adjust the above levels depending on the size of your organization, your industry, and the amount of Personally Identifiable Information (PII) that you are handling. Your safeguards and residual risks are discussed and you make the decision depending on your level of risk tolerance as to which level you need to be at.

If the risks of data breaches and ransomware are keeping you up at night, this assessment can help give you peace of mind that your organization is adequately protected. Even if you think you have a good IT team, having an independent third party—that can translate cyber risks into non-techie terms you can understand—can validate that your business is secure and allow you to sleep better at night.