Virtual CISO · Assessment
A gap analysis built for your security class, not a generic checklist
Most gap analyses start from a list somebody downloaded. Yours starts from the template that matches the obligation you actually have, gets answered in workshops rather than by email, and ends with a scored report, a task list with owners and dates, and the first view of your risks.
The list is settled before the first question is asked
The starting list decides how much of this lands on your people, and the wrong one costs weeks in either direction. Too long and they stop answering halfway. Too short and the gap is found by an auditor rather than by you.
A template that matches your obligation
Where a national implementation defines formal security classes, we start from it: our own templates for the Hungarian NIS2 classes run to 203, 252 and 262 tasks, built from the implementing decree rather than translated from a generic NIS2 list. Elsewhere we start from the baseline that fits and map it to the national law.
International baselines
Starter, foundational and extended baselines where no single statute drives the work, and CIS Implementation Groups 1 to 3 where a customer has asked for them by name.
Focused sets, alongside rather than instead
Data privacy, incident readiness, AI governance and cyber-insurance readiness. Each runs with the main template rather than replacing it, so the reason you called does not turn into a second project.
And if you do not yet know what applies
Most organizations do not on the first call — whether the law reaches them at all, and at which level. We work that out from what you do and who you supply, before anybody fills in anything.
Asked once, and it decides what you are asked next
Before the questions start we build a profile of the organization: what you do and how you are structured, what your technical environment actually is — on-premises, cloud and SaaS, whether you develop software, whether AI is used anywhere in the business — what sensitive data you hold, personal, health or card, the security tooling you already run, and what you are trying to reach and by when.
That profile is what keeps the assessment from asking about things you do not have. It decides which task sets apply, so a company with no development team is never asked to document a secure development lifecycle, and a company that takes card payments is asked about protecting cardholder data in week one rather than in month four.
Not ready to commit to any of this yet? The free security assessment is a short questionnaire that scores itself, needs no account, and is a reasonable way to find out whether the conversation is worth having.
Scope is a decision you can revisit, not a form you fill in once
Every task in your scope carries the frameworks it serves, so one list answers to NIS2, ISO 27001 and DORA at the same time. A task taken out of scope records why it went rather than simply disappearing.
Six months in you buy a company, start developing software, or a customer writes DORA into a contract. The scope changes and the history stays: what is done keeps its evidence, what is removed keeps its record, and nothing starts over.
- Add a framework mid-engagement and its tasks merge into the list you already have
- Take out what does not apply, with the reason recorded rather than the row deleted
- Every task shows the frameworks it serves and where it stands, so nothing is counted twice
- The starting template becomes your scope on day one, and from then on it is yours rather than ours
One question at a time, with the person who owns the answer
A questionnaire mailed round comes back late, half finished, and confidently wrong in the places that matter most. We run the assessment as a series of short workshops instead.
- 01
One question, one owner
Each question goes to the person whose job it actually is, and gets answered out loud: yes, partial, no, or not applicable. Partial is a real answer here, and it is the one that produces the most useful tasks.
- 02
The note is written while you are still in the room
What was said, and why, is recorded against the question as it is answered — not reconstructed a month later when an auditor asks how you reached that conclusion.
- 03
Two weeks, and that is elapsed time
The questions could be worked through in a single day. They never are: the answers live with IT, operations, HR and whoever owns your contracts, and none of those people has a free day. Two weeks is the realistic figure, and planning for two weeks is what stops it becoming two months.
- 04
Answers move everything immediately
An answer opens or closes a task, changes the policy set and moves the potential posture score as it is given; the validated score follows once somebody has checked the evidence behind it. There is no batch run at the end, and no interpretation phase to wait through.
Not everything is worth asking you about
Some answers are visible from outside, and spending a workshop on them wastes your people. An external exposure scan runs in the first week: what your domains, certificates and published services look like to somebody who has not been introduced.
Where it helps, internal scanning and integrations with the tooling you already run add the same kind of evidence from inside. Findings land next to the tasks they belong to, so this is part of the assessment rather than a separate report nobody opens.
What actually arrives when it is over
- A gap report per framework that names what is missing, rather than reporting a percentage
- A security posture score and a domain radar, showing where you stand against the target level
- A prioritized task list, each task with an owner, a phase and a due date
- The first view of your risk register, built from your business rather than downloaded
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
About two weeks, and that is elapsed time rather than effort. The questions themselves could be worked through in a single day if the right eight people sat in one room, and that has never once happened: the answers live with IT, operations, HR and whoever owns your contracts. We schedule short workshops across two weeks and chase what is outstanding, which is consistently faster than a questionnaire sitting in an inbox.
Yes. Your people can be given an editing role and answer directly in the portal, and for the areas they know cold that works well. It is slower and less accurate than the workshops, because most of the value is in the follow-up question — you said yes, show me where that is written down — and a form never asks it. Mixed is common: you answer what is obvious, we work through the rest together.
No. Findings you already have come in as answered questions with their evidence attached, and the assessment carries on from there rather than re-asking them. What the audit did not look at still has to be answered, and that is usually the larger half — an audit tests a scope, and your obligation is wider than the scope that was tested.
Yes. The assessment exports to CSV — every question, the answer given, the note recorded against it and who answered. It is the same file whether you want it for your own records, for an auditor, or because you are moving the work somewhere else.
Where this sits, and what comes next
Framework mapping
One control answered once, and counted against every framework that asks for it.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.