OFFENSIVE SECURITY · PROFESSIONAL SERVICES
A hardening score you can put in front of the board
An objective, industry-recognised hardening score: the right benchmark selected per asset type, configuration captured, every control scored, and the result delivered as a remediation runbook for engineers and a scorecard built to feed straight into board-level risk reporting. It closes the configuration drift automated scanners alone tend to miss.
ENGAGEMENT AT A GLANCE
ScopeOperating systems, databases, network devices
BasisCIS Benchmarks — Level 1 and Level 2
OutputScorecard + remediation runbook
YOU RECEIVE
Benchmark selection per asset type
Configuration capture from every in-scope system
Control-by-control scoring with evidence
Remediation runbook in execution order
Compliance scorecard for board reporting
WHAT'S COVERED
Scope of the engagement
01
Benchmark selection
The correct CIS Benchmark and profile — Level 1 or Level 2 — for each operating system, database and network device in scope.
02
Configuration capture
Settings captured from the live systems or from exports, so the audit scores what is running rather than what the build document says.
03
Control-by-control scoring
Every benchmark control scored pass, fail or not applicable, with the evidence recorded — line by line, not sampled.
04
Configuration drift
The gap between the build standard and what is actually running — the drift that vulnerability scanners, which look for known flaws rather than weak settings, tend to miss.
05
Remediation runbook
Failed controls written up in execution order, with the setting, the change and the side-effects to test for.
06
Compliance scorecard
An objective score per asset class, built to feed straight into board-level risk reporting and to be compared with the next cycle.
COMMON QUESTIONS
Before you ask
How is this different from a configuration review?
A configuration review is broader — firewalls, EDR, cloud tenants and ICS, against vendor guides as well as CIS. This is the CIS Benchmark itself, applied line by line to operating systems, databases and network devices, and scored so the result is comparable over time and across estates.
Level 1 or Level 2?
Level 1 is the baseline that rarely breaks anything; Level 2 is defence-in-depth and can affect functionality. Which profile applies is agreed per asset type at scoping. Level 2 audits have been delivered for insurance-sector clients.
Can the scorecard go to our board?
It is built for that: an objective score per asset class that feeds directly into board-level risk reporting, with the runbook underneath it for the engineers.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Compliance scorecard by asset class and benchmark profile
Control-by-control results with evidence
Failed controls rated by risk and remediation effort
Remediation runbook in execution order
Baseline for the next assessment cycle
WHAT WE NEED FROM YOU
The systems, databases and devices in scope, with owners
Read-only access or configuration exports
Your build standards, where they exist
The benchmark profile you want to be measured against
FRAMEWORKS THIS EVIDENCES
CIS BenchmarksCIS Controls v8ISO/IEC 27001:2022 Annex A
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.