A FIXED-SCOPE SECURITY MATURITY ASSESSMENT FOR SMEs
Nobody can tell you where you actually stand
Ask most SMEs how secure they are, and the answer usually describes products—a firewall, antivirus, backups and a Microsoft 365 subscription. These products may form part of the security environment, but they do not show whether the organisation has the governance, processes and technical practices needed to prevent, detect and respond to an incident.
The CIS Critical Security Controls v8.1 provide a structured and practical way to answer that question. The framework comprises 18 prioritised controls, supported by specific safeguards, covering areas such as asset management, access control, vulnerability management, data protection, and incident response and recovery.
While the NIST Cybersecurity Framework describes high-level outcomes across Govern, Identify, Protect, Detect, Respond and Recover, the CIS Controls are more prescriptive: they translate those outcomes into safeguards that can be assessed and implemented.
The CIS Implementation Groups scale those safeguards to the organisation’s size, complexity and risk, giving SMEs a proportionate baseline and a clear roadmap for improvement.
What you receive
Scored maturity assessment
Every safeguard in scope assessed and scored, with maturity reported per control and overall.
Implementation group( IG) scoping
Assessment against IG1, IG2 or IG3 as appropriate — you are not measured against a control set built for an enterprise.
Executive summary
A concise report for the owner or board explaining where you stand, what matters most and the effort required to close the priority gaps.
Technical findings
A detailed register for whoever does the work, with specific remediation guidance.
Prioritised roadmap
Remediation sequenced by risk reduction per rand, so the first actions are the ones that matter.
Mapping to other standards
Findings mapped to ISO 27001, NIST CSF or Joint Standard requirements where relevant, so the work counts twice.
How the engagement runs
Fixed scope, fixed price. Typically two to three weeks
The assessment has a fixed scope and price. There is no discovery phase that turns into an open-ended engagement.
A typical assessment runs two to three weeks: a scoping conversation, information gathering and interviews, technical review of the environment, then a findings workshop where the results are presented and discussed.
Your scored results are handed over as a workbook you keep. Reassessing against the same baseline later shows movement rather than starting from scratch — which is what boards, insurers and enterprise clients increasingly want to see.
