Standards-Based Cyber Security Assessments

Next Tier conducts assessments of cyber security and maturity under specific standards, including but not limited to, the NIST Cyber Security Framework (“CSF”), NIST 800-53, the Department of Financial Services Cybersecurity Regulation, the Department of Homeland Security’s Security Directives 1 and 2, the Security and Exchange Commission’s Cybersecurity Rules, the MITRE Att&Ck Framework, and other standards.

Next Tier:

  • determines whether defenses are aligned with top risks,
  • provides expert scoring and qualitative assessments about strengths and gaps regarding technology, people, and process under the relevant standards, and
  • provides prioritized, actionable, and easily consumed recommendations for improvement.

A distinguishing feature of these assessments is that we identify and provide solutions for structural problems that have kept the cyber program from progressing.  These can include organization design, political conflicts, tone at the top/governance, under-funding/under-staffing, misalignment among technology/people/process, lack of urgency, and lack of understanding about the anatomy of the most likely threats facing the client company.

Standards-Based Cyber Security Assessments

Next Tier conducts assessments of cyber security and maturity under specific standards, including but not limited to, the NIST Cyber Security Framework (“CSF”), NIST 800-53, the Department of Financial Services Cybersecurity Regulation, the Department of Homeland Security’s Security Directives 1 and 2, the Security and Exchange Commission’s Cybersecurity Rules, the MITRE Att&Ck Framework, and other standards.

Next Tier:

  • determines whether defenses are aligned with top risks,
  • provides expert scoring and qualitative assessments about strengths and gaps regarding technology, people, and process under the relevant standards, and
  • provides prioritized, actionable, and easily consumed recommendations for improvement.

A distinguishing feature of these assessments is that we identify and provide solutions for structural problems that have kept the cyber program from progressing.  These can include organization design, political conflicts, tone at the top/governance, under-funding/under-staffing, misalignment among technology/people/process, lack of urgency, and lack of understanding about the anatomy of the most likely threats facing the client company.