A data breach now costs a U.S. company an average of $11.5 million, according to IBM’s 2026 Cost of a Data Breach Report. The global average hit a record $4.99 million, up 12% in one year (IBM, 2026).
Most of those companies lacked one thing: a clear, independent picture of their real weaknesses. That’s what a cybersecurity assessment provides. For 100 years, Windes has helped businesses see risk clearly, and our Technology & Risk team brings more than 30 years of experience auditing cyber, data, and regulatory risk.
Book a cybersecurity assessment and find your gaps first.
What Is a Cybersecurity Assessment?
A cybersecurity assessment is an independent evaluation of how well an organization protects its systems, data, and people from cyber threats. It identifies vulnerabilities, measures how likely and costly each risk is, and produces a prioritized plan to fix the most important gaps first.
Think of it as a physical exam for your business, covering people and processes as well as technology.
Every assessment measures the CIA triad: confidentiality (only the right people see sensitive data), integrity (data hasn’t been altered), and availability (systems run when you need them). Together, these describe your cybersecurity posture.
Why Businesses Need a Cybersecurity Assessment
Breach costs are at a record high
U.S. breaches now average $11.5 million and take 247 days to identify and contain (Baker Donelson summary of IBM 2026). Closing even one major gap usually costs a small fraction of that.
Customers, insurers, and lenders are already asking
In our experience, most companies bring in an advisor about six months later than they should, usually when a questionnaire, insurance renewal, or contract clause arrives with a deadline attached. An assessment done ahead of time turns that scramble into a formality.
Mid-sized companies are targets, not bystanders
Attackers see mid-sized businesses as easier targets that still hold payroll data, financial records, and access into larger partners’ systems.
Benefits beyond avoiding a breach
- Smarter spending on the controls that reduce the most risk
- Fewer disruptions by fixing weak backups and single points of failure
- Easier compliance with documented due diligence
- Clearer decisions, with risk explained in dollars, not jargon
Real-World Breaches an Assessment Would Have Flagged
Most major breaches start with a basic, fixable gap.
Change Healthcare: a remote-access portal with no MFA
In 2024, attackers used stolen credentials on a remote-access portal that lacked multi-factor authentication (MFA) (TechTarget). The company paid a $22 million ransom (Dark Reading).
CDK Global: one vendor, 15,000 dealerships down
A 2024 ransomware attack on CDK Global sent about 15,000 auto dealerships back to paper for roughly two weeks, with estimated dealer losses above $1 billion (TechTarget). The dealers weren’t hacked; they had no backup plan for a critical vendor.
Target: an HVAC vendor’s stolen credentials
In 2013, attackers entered Target’s network with credentials stolen from an HVAC contractor and reached data on about 40 million cards.
Equifax: an unpatched application
In 2017, attackers exploited a flaw that had a fix available for months, exposing data on about 147 million people.
MGM Resorts: a help-desk phone call
In 2023, an attacker posing as an employee talked MGM’s help desk into granting access. MGM estimated the quarterly hit at about $100 million.
Each was a known gap an assessment checks for.
Types of Cybersecurity Assessments
Assessment type | What it answers | Typical frequency |
Risk assessment | Which risks matter most to the business? | Every 12–18 months |
Vulnerability assessment | Where are the technical weaknesses? | Quarterly or continuous |
Penetration test | Could an attacker actually get in? | Annually or after major changes |
Security and compliance audit | Do our controls meet a standard like SOC 2? | Annually |
Third-party risk assessment | Are our vendors putting us at risk? | At onboarding, then by risk tier |
Compliance gap assessment | How far are we from meeting a framework? | Before a certification or audit |
Cyber maturity assessment | How developed is our program overall? | Every 1–2 years |
Cybersecurity due diligence | What cyber risk are we buying? | Before a deal closes |
AI risk assessment | Is our AI use creating new exposure? | As AI use expands |
A risk assessment is the foundation; see What You Should Know About Cybersecurity Risk Assessments. A vulnerability assessment checks that every door is locked, while a penetration test tries to break in (Pen Test vs. Vulnerability Assessment). Windes also offers third-party risk management, cybersecurity due diligence, and a complimentary AI risk assessment.
Which assessment do you need?
- Never had one? Start with a risk assessment.
- Customer questionnaire? A compliance gap assessment.
- Need SOC 2, ISO 27001, or CMMC? A readiness assessment, then the audit.
- Want to know if you can be hacked? A penetration test.
- Acquiring a company? Cybersecurity due diligence.
- Employees using AI tools? An AI risk assessment.
What a Cybersecurity Assessment Evaluates
- Assets and data: what you have and where sensitive data lives
- Network and endpoints: firewalls, Wi-Fi, laptops, and servers
- Identity and access: MFA, permissions, and removing access when people leave
- Patching and configuration: whether updates are timely and systems are secure
- Cloud and SaaS: including “shadow IT” outside IT’s view
- Vendors: who can reach your systems and what contracts require
- Policies, people, and training: written rules and phishing awareness
- Incident response and backups: a tested plan and backups that restore
- AI tool use: which tools employees use and what data goes in
How a Cybersecurity Assessment Works: 6 Steps
Step 1: Define scope and objectives
Decide what’s in scope and why: an audit, an insurer’s request, or a baseline.
Step 2: Inventory and value your assets
List hardware, software, data, and cloud services, then rank them by business importance, not just price.
Step 3: Identify threats and vulnerabilities
Map realistic threats, then find exploitable weaknesses through scanning and testing.
Step 4: Analyze likelihood and impact
Plot each risk on a risk matrix. Risk before controls is inherent; what remains after is residual.
Step 5: Prioritize against your risk tolerance
Weigh each asset’s value against the cost of protecting it. Then mitigate, transfer (often through insurance), avoid, or accept each risk.
Step 6: Remediate, report, and monitor
Fix what matters, give every item an owner and a date, report in business terms, and retest on a schedule.
Cybersecurity Frameworks and Standards
NIST Cybersecurity Framework 2.0
NIST CSF 2.0 (February 2024) has six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The new Govern function makes cybersecurity a leadership responsibility.
ISO/IEC 27001 and 27005
The International Organization for Standardization’s standard for information security management; 27005 covers risk management.
CIS Critical Security Controls v8.1
The successor to the old “SANS Top 20”: 18 prioritized technical controls, scaled for smaller organizations.
SOC 2 and AICPA reporting
The AICPA’s criteria focus on evidence that controls actually work.
How to choose
Start with NIST CSF and CIS Controls when building a program. Use SOC 2 for U.S. customers and ISO 27001 for international partners. Regulations come first when they apply.
Regulations That Require or Expect an Assessment
California: new CCPA cybersecurity audit rules
Effective January 1, 2026, certain California businesses must complete annual independent cybersecurity audits. First certifications are due April 1, 2028 for businesses over $100 million in revenue, 2029 for $50–100 million, and 2030 for those under $50 million (Hunton). An existing assessment can’t automatically substitute (Polsinelli).
Healthcare: HIPAA
The HIPAA Security Rule requires a documented risk analysis of electronic health information.
Card payments: PCI DSS v4.0.1
Requires regular vulnerability scans and annual penetration testing.
Auto dealers and financial services: FTC Safeguards Rule and NCUA
The FTC Safeguards Rule requires a written risk assessment for many non-bank financial businesses, including dealers that arrange financing. Credit unions face NCUA and FFIEC expectations (Windes on credit unions).
Employee benefit plans: DOL guidance
Plan fiduciaries must manage cyber risk, including vendors holding participant data (Cybersecurity Requests in DOL Audits).
Defense contractors: CMMC
Phase I self-assessments remain required. Phase II third-party assessments were suspended on July 13, 2026 (McGuireWoods). Delayed is not eliminated.
Tools and Techniques Used in an Assessment
Category | Common examples |
Vulnerability scanners | Nessus, Qualys, OpenVAS |
Penetration testing | Metasploit, Burp Suite |
SIEM platforms | Splunk, Microsoft Sentinel |
Network mapping | Nmap, Wireshark |
Phishing simulation | KnowBe4, Cofense |
External attack-surface ratings | Security ratings services |
A scan might flag 400 findings; an assessor tells you which five matter.
Point-in-Time Assessments vs. Continuous Monitoring
An assessment is a snapshot, and risk changes daily. External ratings help between assessments but can’t see inside your business.
Our view: you need both, connected. Our cyber risk management service keeps findings current and tracks remediation.
Limitations and Common Mistakes to Avoid
- Treating a passed audit as proof of security. Compliance isn’t the same as protection (read more).
- Scoping too narrowly. Scope by risk, not convenience.
- Ignoring vendors. IBM ranks supply-chain compromise as the second most common attack vector.
- Relying on tools alone. Scanners miss weak processes and social engineering.
- A report no one acts on. Insist on owners and dates.
- Treating cyber as IT-only. Finance, HR, legal, and the board belong at the table.
- Doing it once. Without follow-up, findings go stale.
How to Prepare for a Cybersecurity Assessment
Who should be involved
An executive sponsor with authority, IT or your managed IT provider, finance and your controller, HR, legal or compliance, and key vendors.
What to have ready
- An inventory of hardware, software, and cloud services
- A network diagram, even a rough one
- Security policies and vendor contracts
- Prior assessments and recent customer or insurer questionnaires
- Your cyber insurance policy, incident response plan, and backup plan
What You Get: Reading Your Assessment Report
Executive summary in business terms
The top five to ten risks, what each could cost, and what fixing them costs.
Risk register and remediation roadmap
Every finding with its score, plus a plan showing what to fix first, who owns it, and when.
Priority controls most assessments recommend
MFA everywhere, timely patching, endpoint detection and response, tested backups, security awareness training, a tested incident response plan, vendor reviews, and prompt access removal. On a tight budget, start with MFA, patching, and training.
Why a CPA Firm? The Windes Approach
Auditors are trained to test whether controls actually work, gather evidence, and explain risk in financial terms. We approach cybersecurity the way an assessor or regulator will, focusing on evidence and defensibility.
An auditor’s view of cyber risk
“When we evaluate internal controls, cybersecurity is no longer a separate topic. Who can approve a payment, change vendor bank details, or access payroll is a financial control and a cyber control at the same time.”
— Jeff Ehlers, CPA, Partner, Audit & Assurance Services, Windes
Beyond the report
We stay involved: building your incident response plan, tracking remediation, reporting to your board, providing vCISO leadership, and preparing you for SOC 2, ISO 27001, NIST, and CMMC through our cybersecurity compliance services.
Frequently Asked Questions
How often should a business get a cybersecurity assessment?
At least every 12 to 18 months, plus a focused review after major changes like a cloud migration or acquisition.
How long does a cybersecurity assessment take?
A focused assessment typically takes a few weeks. Full framework readiness usually takes six to twelve months.
What affects the cost of an assessment?
Scope, penetration testing, the number of frameworks involved, and how organized your documentation is.
What are the 5 C’s of cybersecurity?
Change, compliance, cost, continuity, and coverage: a quick checklist for evaluating any security program.
Can we assess ourselves?
Our free Risk Assessment Scorecard is a good start, but teams miss their own blind spots, and many customers, insurers, and California’s CCPA rules expect independent review.
Does cyber insurance require an assessment?
Many carriers ask detailed control questions before issuing or renewing coverage. Inaccurate answers can complicate a claim; an assessment gives you defensible ones.
Book Your Cybersecurity Assessment
Every breach in this guide began with a gap someone could have found. A cybersecurity assessment shows where you’re exposed, what each risk could cost, and what to fix first. For 100 years, Windes has helped businesses see risk clearly and act with confidence. Our Technology & Risk team brings that discipline to cybersecurity, and we stay involved after the report.
Don’t wait for an incident to reveal your gaps. Book a cybersecurity assessment with Windes today.
