Assess

Security capability assessment

See where your security program stands, capability by capability, and what to fix first. The first step of Assess, Build, Operate.

Talk to a security specialist

Share what you need and a consultant will follow up to book a call.

What the assessment covers

Carried out inside your environment, against the framework you are being measured on.

icon-7

Current state review

Systems, documentation and data flows reviewed inside your environment, with the people who operate them.

icon-5

Capability scoring

Each of the security capabilities an effective program is built from, scored on the maturity scale, so the gaps are visible as a shape rather than a list.

icon-6

Gap analysis against your framework

SOC 2, ISO 27001, NIST CSF or CPCSC. Where no framework has been named, a baseline with findings mapped so a later decision does not mean starting again.

icon-3

Findings rated by consequence

Rated by what an attacker or an auditor would do with them, rather than by control count.

icon-9

Remediation plan sequenced by dependency

Owners and effort against each item. Written so it can be handed to an internal team, to Truvo, or to a third party.

icon-8

Findings presented to the people who act

A working session with your team, and with your board or your customer where that was the trigger.

Assess, Build, Operate, applied to the whole security program

Timeline follows the size of the estate and how much documentation exists, and is set before the engagement starts. A documented methodology, led by a senior architect with more than ten years of enterprise security experience and a CISSP.

01

Assess

Which systems, which framework, who we interview. Access happens inside your environment. Truvo takes no custody of production data.

02

Build

Systems, documentation and data flows reviewed. Capabilities scored. Findings rated by consequence.

03

Operate

Written report with current state, rated findings and a sequenced remediation plan, then a working session with the people who will act on it.

What you hold at the end

A written report and a plan that can be handed to anyone, plus the session where the findings are walked through with the people who will act on them.

Book a strategy call

  • Current-state report

  • Capability scores on the maturity scale

  • Findings rated by attacker and auditor consequence

  • Gap analysis against your framework

  • Remediation plan with owners and effort

  • Board or customer presentation, where that was the trigger

What the assessment settles

Three questions a security lead has, answered in writing.

Where the program stands

Capability by capability, on a scale, rather than a pass or fail on a control list.

What an auditor or attacker would do with each gap

The same finding rated two ways, so the fix order holds up to both.

What to fix first, and what it takes

Sequenced by dependency with an owner and an effort estimate against each item.

What the certification does not cover

The systems outside the boundary, the controls that pass on paper while failing in operation, and the customer questions the report does not answer.

When an assessment is the right call, and when it is not

Most companies asking for a penetration test need the assessment first. We say which one the situation calls for on the scoping call.

Right call when

  • A customer, insurer or board has asked for an independent read on your security posture

  • You hold SOC 2 or ISO 27001 and know the boundary covers less than the customer assumes

  • A framework decision is coming and you want to know the distance before committing to an audit date

  • A new CTO, CISO or IT lead wants the real picture in writing

Wrong call when

  • You need to know whether one specific system can be broken into today; that is a penetration test

  • You want a rated risk register, which is a different engagement; that is a risk assessment

  • No one is in place yet to own the remediation plan afterwards

Frequently asked questions

A penetration test answers whether a specific system can be broken into on the day it is tested. An assessment answers whether the program around that system produces a defensible security posture over time: how decisions get made, what evidence exists, where the gaps sit, and what order to fix them in. Most companies asking for one need the assessment first, because a test report with no program behind it produces a list no one owns. Truvo runs both and will say which one the situation calls for.

Often yes, and the reason is scope. A certification covers the boundary the company drew and the controls inside it, on the evidence the auditor sampled. An assessment looks at the systems outside that boundary, the controls that pass on paper while failing in operation, and the questions a customer is asking that the report does not answer. The finding that comes up most often is a control that works in one environment and was never extended to the other three.

Whichever one you are being measured on. In practice that is SOC 2 or ISO 27001 for commercial customers, NIST CSF where a customer or insurer has asked for a maturity rating, and CPCSC or CMMC where defence contracts are involved. Where no framework has been named, the assessment runs against a baseline and maps the findings so that a framework decision later does not mean starting again.

Timeline follows the size of the estate and how much documentation already exists, and it is set before the engagement starts rather than discovered during it. The deliverable is a written report covering current state, rated findings, and a sequenced remediation plan, plus a working session where the findings are walked through with the people who will act on them. The plan is written so that it can be handed to an internal team, to Truvo, or to a third party.

No. Access happens inside your environment, in your platforms and the third party systems you grant access to. Truvo does not take custody of, store, or host your production data or personal information in order to run an assessment. For teams whose own customers ask that question in a security review, that answer is part of what the engagement produces.

Talk to the architect who would do the work

A 30-minute call. We look at your environment and say plainly whether we can help and what it would take.

From the blog: assessing a security program

Illustrated SOC 2 roadmap showing a CTO moving through three stages: Assess (blue), Build (gray), and Operate (magenta), progressing from Type 1 to Type 2. Bottom panel highlights key SOC 2 costs: readiness assessment, policies and controls, CPA audit fee, and penetration testing.

SOC 2 Compliance for SaaS: The CTO's Guide

TL;DR: SOC 2 compliance for a B2B SaaS company is a sales requirement before it is a security exercise: enterprise buyers use the report to clear ...

Learn More
Flat vector infographic showing a SOC 2 budget split into readiness work, an independent audit, and penetration testing, with total cost driven by scope, infrastructure, Type 1 or Type 2 audit, and organizational maturity.

SOC 2 Cost 2026: Real Price Ranges by Line Item

A SOC 2 audit fee alone costs roughly $7,500 to $100,000 or more in 2026, depending on report type, company size and the audit firm, with published ...

Learn More
Split illustration showing an automated compliance dashboard with green checkmarks beside a consultant’s desk with a gap assessment, notes, and highlighted risks, contrasting platform monitoring with human review.

What a SOC 2 Readiness Assessment Includes (With or Without Drata)

A SOC 2 readiness assessment and Drata solve different problems. The assessment tells you whether your control environment is adequate before the ...

Learn More