Cybersecurity Hygiene Assessment
A broad, time-boxed survey of foundational security posture anchored on CIS Controls v8 IG1 and NIST CSF 2.0, producing a defensible baseline and an honest next-step recommendation for organizations not yet sure what deeper engagement they need.
A cybersecurity hygiene assessment is the first engagement to take when the organization isn’t yet sure whether it needs a penetration test, a compliance audit, or something else entirely. Aegis & Spear runs these as broad, time-boxed surveys of foundational security posture, anchored on the CIS Controls v8 Implementation Group 1 baseline and cross-walked into NIST CSF 2.0 for strategic framing. The engagement produces a prioritized read on where the organization stands across identity, endpoint, network, backup, and logging fundamentals, along with a concrete next-step recommendation. That recommendation is honest: sometimes it points to a deeper engagement, sometimes it points to internal remediation work that should happen before any external testing produces value, and sometimes it points to a different firm entirely.
What’s in scope
A hygiene assessment surveys foundational controls across the organization’s actual environment. The engagement is breadth, not depth. The framework anchor is the CIS Controls v8 Implementation Group 1 baseline, which covers the foundational safeguards most small and mid-sized organizations are expected to have in place regardless of regulatory environment.
Documentation review. A lighter-touch review than a full compliance audit. Existing policies, standards, and operational procedures are reviewed at the level of “does this exist and is it being followed in practice” rather than “does this satisfy every clause of a specific framework.” The output identifies where foundational documentation is missing entirely and where it’s stale enough to be inaccurate.
Configuration review. A sample of foundational systems is reviewed against the CIS baseline: identity provider configuration (MFA enrollment, conditional access posture, privileged account separation), endpoint posture (patching cadence, endpoint protection coverage, encryption status), network fundamentals (egress filtering, segmentation, remote access), backup posture (coverage, immutability, restore testing), and logging posture (collection coverage, retention, monitoring). Sample sizes are agreed in pre-engagement and are sized for breadth, not exhaustive enumeration.
Operational assessment. Interview-based assessment with IT and security staff covering how the organization actually operates day to day: who holds the keys, how onboarding and offboarding work, how change management runs, how the organization would notice and respond to a security event today. The job is to characterize the operational baseline as it actually exists, not as the documentation says it should.
Deliverable scope. A written report keyed to the CIS Controls baseline and cross-walked to NIST CSF 2.0, a prioritized remediation list, a clear next-step recommendation, and a debrief with client leadership. A letter of attestation confirming engagement completion is available on request. The engagement is time-boxed, typically two to three weeks, and is scoped and priced for accessibility relative to a full compliance audit or penetration test.
How engagements actually run
Engagements run in three short phases against a defined timeline. Pre-engagement covers scope confirmation (which systems are in sample, which interviews are needed, what foundational documentation will be reviewed), escalation contacts, and the timeline. The scope is committed in writing before any active work begins.
Discovery is the first active phase. Foundational documentation is collected and reviewed at the level appropriate to a baseline survey. The configuration sample is reviewed against the CIS baseline. The output of this phase is a working inventory of what’s in place, what’s partially in place, and what’s missing.
Interviews are the second phase. IT and security staff are interviewed against a structured framework covering identity, endpoint, network, backup, logging, and incident response operations. The interviews are framed to surface the gap between documented procedure and operational practice. Staff time required is modest: typically two to three sessions of one to two hours each, across IT leadership and the relevant operational owners.
Synthesis and reporting closes the engagement. Findings are organized by CIS Control family, cross-walked to NIST CSF 2.0 for strategic framing, and prioritized by effort and impact rather than by safeguard number. The next-step recommendation is concrete: organizations with technical gaps that need exploitability validation get pointed to penetration testing; organizations with regulatory exposure get pointed to compliance audit work; organizations whose human-layer controls are untested get pointed to social engineering assessment; organizations that need more foundational work before any deeper engagement get told that directly. The firm’s approach covers engagement mechanics in more depth across all service lines.
What makes this engagement different
Two things distinguish this engagement from a commodity baseline assessment.
The first is honesty about what the engagement is. This is a foundational survey, not a comprehensive assessment. The deliverable is a defensible baseline read, not a deep technical or regulatory analysis. The engagement is structured to feed into a deeper Tier 1 engagement when findings warrant, and the page says so directly rather than burying it. The pricing reflects the depth. The structural reality is that some hygiene assessments produce a “you’re in better shape than you think, no further engagement needed” outcome, and the report says so when that’s the case rather than padding the deliverable to justify the engagement fee.
The second is honesty about downstream path. Clients leave knowing what they should do next, even when “next” is internal remediation work that should happen before any external testing produces value, or a different firm entirely (a CPA firm for SOC 2 attestation, an MSP for managed security operations, a specialized vendor for a specific environment Aegis & Spear is not the right fit for). The deliverable is written so a CFO or operations leader can act on the next-step recommendation directly, without translation.
What good outcomes look like
At engagement close, the client has a defensible read on where the organization actually stands across foundational security controls, what’s working, and what isn’t. The report is keyed to the CIS Controls v8 IG1 baseline and cross-walked to NIST CSF 2.0, which means a downstream compliance audit or penetration test can pick up directly without re-baselining.
The deliverable includes the written report (foundational posture by CIS Control family, prioritized remediation list, next-step recommendation), the underlying evidence the findings are drawn from, and a debrief call with client leadership. A letter of attestation confirming engagement completion is available on request.
A hygiene assessment does not make the organization secure, and the report says so. What it produces is the kind of read that lets a CFO approve deeper spend on evidence rather than impression, lets new IT leadership build a remediation plan against a known baseline rather than guessing, and lets an organization preparing for a first client security questionnaire answer the questionnaire honestly.
Organizations that act on a clear next-step recommendation frequently realize cost savings versus engaging deeper services blind. A penetration test scoped against an environment whose foundational posture is already characterized produces sharper findings than one that has to re-discover those things from scratch.
Who this fits, and who it doesn’t
This engagement fits organizations under one hundred employees with no prior independent security assessment, organizations with new IT or security leadership that inherited an unknown environment, organizations preparing for a first client security questionnaire, and organizations whose executive leadership wants a defensible baseline before approving deeper spend on penetration testing, compliance work, or managed services.
This engagement does not fit organizations that already know they need a penetration test (skip the hygiene step and engage on testing directly), organizations with active regulatory or audit obligations that require framework-specific assessment (a compliance audit is the right engagement), or organizations seeking a marketing claim to put on a website. The hygiene assessment produces a defensible internal baseline and a next-step recommendation; it is not a public attestation or certification.
Talk to us
If you are considering a cybersecurity hygiene assessment, reach out at contact@aegisandspear.com. Useful context in a first message: the rough size of the organization, whether any independent assessment has been conducted previously, the driver for the assessment (new leadership, client questionnaire, executive request, regulatory exposure not yet defined), and any specific area of concern. Response within two business days. The contact page covers initial outreach in more depth.