Question 1

How long does a cyber maturity assessment take?

Accepted Answer

Two weeks from kickoff to findings for a typical SMB or mid-market environment. Larger or multi-entity environments may need three to four. The scoping call fixes the timeline along with the fee.

Question 2

How is this different from a penetration test?

Accepted Answer

A pen test answers one question: can we break in? A maturity assessment answers the bigger one: how strong is your whole program — governance, detection, response, identity, data protection — measured against a recognized framework. Most organizations need the assessment first; it tells you whether a pen test is even the right next spend.

Question 3

What does a cybersecurity maturity assessment cost?

Accepted Answer

It's a fixed-fee project, not hourly billing — the price depends on organization size, environment complexity, and framework scope, and you get the number in writing before we start. The free 30-minute discovery call is where we scope it.

Question 4

Will the findings report satisfy my cyber insurer or auditor?

Accepted Answer

Yes — that's what it's built for. The report maps to the framework your insurer or auditor recognizes, documents controls with evidence, and flags the specific gaps underwriters ask about at renewal.

Question 5

Do you assess against Canadian frameworks like OSFI B-13?

Accepted Answer

Yes. OSFI Guideline B-13 maps closely to NIST CSF, and for federally regulated financial institutions we align findings directly to B-13's technology and cyber risk expectations — an angle US-based assessment providers typically can't deliver.

Question 6

Which framework should we use?

Accepted Answer

NIST CSF 2.0 if you want the most defensible posture for insurance and customer questionnaires. CIS Controls v8 if you want a more prescriptive, action-oriented starting point. We'll recommend based on your situation.