Three-week Security Posture Initiative
Architectural gap analysis against NIST CSF 2.0, mapped to your current environment. Risk register in financial terms. Prioritized remediation list with effort and risk-reduction estimates. Output formatted for both the CISO and the board. For a shorter starting point, see the Cyber Risk Review.
Who this is for
A defensible security posture assessment, board-ready in three weeks.
CISO
You need a defensible posture document for board, audit committee, or cyber insurance renewal.
CIO
You inherited a security program and want an outside read on where the gaps sit before committing budget.
Board / Audit Committee
You want an outside view of technology risk in financial terms.
CFO
You need the security spend question framed in risk-reduction terms.
Scope
What this Initiative delivers, and what it does not.
Scope is fixed at signing. Items marked Program are available in the Technology Operating Partner Program. The Initiative alone does not include them. Items tagged with an outside source require a separate specialty engagement.
In scope
- NIST CSF 2.0 gap analysis by subcategory (or your specified framework: CIS v8, ISO 27001 Annex A, sector-specific)
- Identity posture review (Microsoft Entra ID, on-prem AD authentication, conditional access, MFA coverage)
- Read-only review of Microsoft 365 configuration where access is provided
- Policy and documentation review (existing security policies, incident response, vendor risk)
- Risk register populated and quantified in annualized loss expectancy (ALE) where data permits
- Prioritized remediation list with effort estimates and risk-reduction estimates
- Board-ready summary deck
Out of scope
- Penetration testing or red-team engagementSpecialty firm
- Endpoint or network vulnerability scanningSpecialty firm
- Implementation of any remediationProgram
- Security tool selection or procurementProgram
- Formal certification or attestationQualified assessor
- Forensic incident responseSpecialty firm
Inputs
What we need from you
Provided at kickoff. Missing inputs delay the Initiative; they do not change scope.
- Read-only access to your identity tenant (Microsoft Entra ID) and M365 admin center
- Existing security policies, incident response plan, and prior assessment reports
- Vendor risk register or third-party inventory if one exists
- Two to four stakeholder interviews (CISO, IT lead, GC or compliance lead, optionally CFO)
Timeline
Week by week
Status updates throughout. A mid-point check confirms direction before the deliverable lands.
Week 1
Kickoff, access, configuration review
Scope confirmation, access provisioning, document intake. Read-only configuration review and identity posture analysis. Policy and documentation review begins.
Week 2
Interviews and control mapping
Two to four targeted stakeholder interviews. Gap mapping by subcategory against NIST CSF 2.0. Mid-point direction check with your CISO at the end of the week.
Week 3
Risk register, roadmap, walkthrough
Risk register quantified in financial terms where data permits. Prioritized remediation list. Board-ready deck drafted. Walkthrough call and deliverable handoff.
Output
What you walk away with
- Written security posture report mapped to NIST CSF (or chosen framework), by subcategory
- Risk register with each gap quantified in ALE terms where data permits
- Prioritized remediation list (effort, risk-reduction estimate, dependency)
- Board-ready summary deck (one slide per major theme)
- 60-minute walkthrough call
Limits
What this Initiative does not cover
This Initiative produces an advisory document. It is not a penetration test, vulnerability scan, audit, or certification. The risk register uses annualized loss expectancy (ALE) with ranges, and your Microsoft 365 tenant data where available. Quantification is directional and improves as more data is provided. Engage a qualified pen-testing firm for adversarial validation, and a qualified assessor for formal certification.
If you are a portfolio company
How the work calibrates to the PE-backed seat.
If your company is PE-backed, four things shape how the Initiative is timed and sequenced.
- Board reporting cycle. Output is sized to land before the next quarterly board read.
- Exit window timing. Decisions made 12 to 24 months before exit can affect the bid. Where applicable, findings are tagged with the exit-window timeline they affect.
- Add-on integration tempo. Findings that relate to acquisition integrations are listed separately so the deal team can price them in or sequence the integration around them.
- Cost room by hold stage. Recommendations take account of where the portco sits in the hold. A company in early hold has more room to change cost than one 12 months from exit.
Related
Initiatives that pair with this one
FAQ
Questions buyers ask first
What is NIST CSF 2.0 and do we need to follow it?
NIST CSF 2.0 is a voluntary framework that boards often use as a reference. It is organized around six functions: Govern, Identify, Protect, Detect, Respond, Recover. Version 2.0 added Govern as a top-level function, which fits how boards oversee cyber risk. The Security Posture Initiative maps your current practices to CSF 2.0 and produces a prioritized remediation list. It does not assign a Tier rating.
How does a board cybersecurity dashboard differ from a CISO dashboard?
Board reporting leads with dollars and trends, and CISO dashboards lead with counts and events. A board view can fit six tiles: overall posture with trend, ALE baseline with quarter-over-quarter change, mean time to detect and respond, third-party vendor risk summary, compliance status by framework, and top three risks with owner and due date. The Initiative delivers a board deck. The Technology Operating Partner Program can keep the same format updated each quarter.
What is the difference between NIST CSF and ISO 27001?
NIST CSF is a voluntary US framework organized around six functions and oriented toward risk management. ISO 27001 is an international certifiable standard organized around an Information Security Management System. Most mid-market organizations run CSF as the internal risk language and pursue ISO 27001 or SOC 2 when customers contractually require it. The Security Posture Initiative maps your controls to CSF 2.0 or the framework you choose. Certification is a separate engagement with a qualified assessor.
For your role
Where this Initiative fits into the wider Preside view
Inside the broader program
When the Initiative becomes the standing engagement
This Initiative is a one-time fixed-price engagement. If it helps, the Technology Operating Partner Program can keep the risk register and board deck current each quarter, at one of four Program levels.
Ready to scope this
Three-week Security Posture Initiative. Fixed scope.
Tell us your situation in a few lines. We reply within one business day to confirm the Initiative or suggest a better fit.
Not sure this is the right Initiative for your situation? Use the four-question Find Your Path tool for a personalized recommendation.