Your Board Wants a Security Baseline. Show the Evidence and the Priorities.

Every engagement is led by Temi. Over two decades of security, audit and governance experience, applied to your business.

A first security program, a buyer review, a board budget discussion or a change in business ownership may each need a different assessment boundary. Agree the intended audience, the entities included and the question the report should answer before choosing a rating method.

For several business units or portfolio companies, agree a common set of criteria and record differences in scope and evidence availability. An apparent score difference is meaningful only when the underlying assessments are comparable. A customer, investor or insurer decides whether the resulting evidence meets its own requirements.

We review governance, asset and data understanding, access, change, protection, detection, incident readiness, recovery and supplier risk as applicable. The written scope selects the domains and evidence depth. A transparent boundary keeps the results meaningful for the decision you need to make.

If CSF 2.0 is part of your chosen approach, a Current Profile describes the outcomes your organization achieves now and how fully it achieves them. A Target Profile records the outcomes you want to achieve, prioritized around your objectives and requirements. Comparing them helps identify gaps and develop an action plan. [1]

Agree the Profile’s scope before making the comparison. Record the practices and evidence supporting the current position, then identify the desired changes and their priorities. Connect the resulting actions to owners, resources and planned dates. Update the Profiles as the work proceeds or assumptions change. A target records an intention; it does not demonstrate that the outcome has been achieved. [1]

CSF Tiers can add context about the rigor of risk governance and management. Leadership selects the relevant Tier characteristics in light of the organization’s needs and constraints; they guide the methodology rather than replace it. [2] Discuss whether Profiles or Tiers are useful for your scope before including them in the assessment plan.

ASD’s Essential Eight combines eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Its maturity model defines levels Zero to Three. Choose a target suited to the environment and the actual requirement, then plan progress across all eight strategies. A general cybersecurity score does not establish an Essential Eight maturity level. [1]

Confirm the systems, model version, target level and evidence the requester expects. ASD designed the Essential Eight for internet-connected IT networks; applying its principles elsewhere requires attention to the environment. Where an alternative control is proposed, document which requirement it addresses and demonstrate equivalent protection. A cloud configuration or signed workload image does not establish equivalence simply because it appears to serve a similar purpose. [1][2]

Keep evidence of implementation distinct from evidence of effectiveness. ASD’s assessment guide differentiates policy statements, configuration records, direct configuration review and testing. Record limitations, exceptions and compensating controls, and agree any specialist testing and access separately. [3]

ASD does not require independent certification of an Essential Eight implementation. An independent assessment may nevertheless be required by a government directive, regulator or contract. Confirm the requested assessment and acceptance terms before making a customer-facing maturity claim. [1] A governance review or improvement roadmap should describe its own scope and should not be presented as a certificate or a completed technical assessment.

Choose the business purpose and criteria. Gather scoped documents and interview owners. Review records and walkthroughs. Calibrate findings using the documented method. Present priorities and constraints to leadership. An improvement roadmap is proposed work, not completed remediation.

The leadership readout explains the material themes, uncertainties and decisions requiring resources. The working findings retain the criteria, evidence references, owners and proposed closure conditions needed by the team responsible for improvement. Agree the audience and permitted use before sharing sensitive findings outside the organization.

See the Sample Assessment Report → A sample illustrates presentation; the engagement proposal defines the actual assessment method, scope and deliverables.

Bring your program priorities, current assessments and available owners. We will discuss the evidence needed for a useful baseline.

Free 30-minute cybersecurity maturity strategy call. No obligation.

Fixed fee confirmed after scoping.