Security capability assessment

A penetration test answers whether a specific system can be broken into on the day it is tested. An assessment answers whether the program around that system produces a defensible security posture over time: how decisions get made, what evidence exists, where the gaps sit, and what order to fix them in. Most companies asking for one need the assessment first, because a test report with no program behind it produces a list no one owns. Truvo runs both and will say which one the situation calls for.

Often yes, and the reason is scope. A certification covers the boundary the company drew and the controls inside it, on the evidence the auditor sampled. An assessment looks at the systems outside that boundary, the controls that pass on paper while failing in operation, and the questions a customer is asking that the report does not answer. The finding that comes up most often is a control that works in one environment and was never extended to the other three.

Whichever one you are being measured on. In practice that is SOC 2 or ISO 27001 for commercial customers, NIST CSF where a customer or insurer has asked for a maturity rating, and CPCSC or CMMC where defence contracts are involved. Where no framework has been named, the assessment runs against a baseline and maps the findings so that a framework decision later does not mean starting again.

Timeline follows the size of the estate and how much documentation already exists, and it is set before the engagement starts rather than discovered during it. The deliverable is a written report covering current state, rated findings, and a sequenced remediation plan, plus a working session where the findings are walked through with the people who will act on them. The plan is written so that it can be handed to an internal team, to Truvo, or to a third party.

No. Access happens inside your environment, in your platforms and the third party systems you grant access to. Truvo does not take custody of, store, or host your production data or personal information in order to run an assessment. For teams whose own customers ask that question in a security review, that answer is part of what the engagement produces.