Cyber Security Assessment and Remediation Services
An assessment finds and ranks weaknesses; remediation fixes them; a retest proves the fix worked. They are often sold separately, so confirm who does each one before you sign.
On this page
The five-step sequence
- Agree on scopeSystems, dates, permission, and rules.
- AssessReview and test within that scope.
- Prioritize findingsRank by risk to your business.
- Assign fixesEvery finding gets a named owner.
- RetestConfirm each fix actually worked.
NIST's Technical Guide to Information Security Testing and Assessment (SP 800-115) covers planning tests, analyzing findings, and developing mitigation strategies. It was published in September 2008, so use it for method and check current tools elsewhere.
Assessment, penetration test, remediation, verification
| Term | What it answers | Typical output |
|---|---|---|
| Assessment | What are our weaknesses, across what scope? | Findings report, which may include non-technical gaps |
| Penetration test | Can a tester actually get past our defenses? | Attack path and evidence. The FTC defines it as attempting to circumvent or defeat security features |
| Remediation | Have we fixed what was found? | Changed configurations, patches, or processes |
| Verification (retest) | Did the fix work, without new problems? | Retest result for each finding |
Our reporting compares layered IoT penetration testing and AI penetration testing vendors in more depth.
What a finding looks like
See what an assessment report includes
Invented to show the format. It isn't from a real report.
- Finding
- Former employee accounts remain active on the remote-access system.
- Evidence
- Export of 14 active accounts matched against the HR list; 3 belong to people who left over 90 days ago.
- Priority
- High, because remote access is internet-facing and one account has administrator rights.
- Owner
- IT manager (customer), with a due date 14 days out.
- Retest result
- Passed: the 3 accounts are disabled, and an offboarding step was added.
Who delivers what
| Activity | Usually done by | Confirm in writing |
|---|---|---|
| Written permission to test | Customer | Who may authorize testing, including for hosted systems |
| Testing and the report | Assessment provider | Report format, delivery date, and evidence included |
| Fixing findings | Customer or its IT provider | Whether the assessor offers fixes and how that is priced |
| Retest | Assessment provider, if contracted | Number of retests included and any time limit |
| Risk acceptance | Customer leadership | Who may decide not to fix a finding, and how it's recorded |
If one firm both finds and fixes problems, ask how the retest stays objective. That doesn't disqualify the firm, but the question deserves a clear answer.
Before you buy
Scope drives price more than any other factor. See how to compare fixed-fee assessment quotes. If a rule requires the test, check the compliance guide first, because an ordinary assessment may not satisfy a specific requirement. If you need help deciding what to test, start with a consulting project.
Does a rule or customer require this test? Check what evidence it actually has to produce.
See the compliance evidence table