Start with critical services and assets
Identify the business services that would matter most if disrupted, then map the applications, identities, data, infrastructure, APIs, backups, suppliers, and people that support them. Record asset owners, business purpose, sensitivity, dependencies, and recovery expectations.
An incomplete inventory is still useful if its gaps are visible. Unknown ownership and undocumented dependencies should be treated as findings, not ignored.
Understand threats and exposure
Consider plausible scenarios such as compromised credentials, exposed services, vulnerable applications, supplier compromise, ransomware, accidental disclosure, or disruption of a critical provider. Review internet-facing interfaces, remote access, privileged accounts, authentication, patching, excessive permissions, API security, and monitoring.
Any active testing must have explicit authorization and a clearly agreed scope. Assessment should never become unapproved testing of systems.
Estimate likelihood and business impact
Prioritize scenarios by considering both likelihood and consequences. Translate technical issues into business language: service downtime, affected customers, exposed information, financial impact, recovery effort, and contractual or regulatory obligations.
Use a consistent rating method and document assumptions. A qualitative scale is often more honest than a precise-looking score when reliable incident data is unavailable.
Review controls and create a roadmap
Review identity and access management, multi-factor authentication, secure configuration, patching, endpoint protection, network segmentation, backups, logging, incident response, supplier oversight, and staff awareness. Verify that controls operate in practice; a policy document alone is not evidence of effectiveness.
For each finding, record evidence, affected asset, business impact, severity rationale, recommended action, owner, target date, and residual risk. NIST CSF 2.0 offers six connected functions—Govern, Identify, Protect, Detect, Respond, and Recover—to structure risk conversations and improvement planning.
What a decision-ready assessment delivers
A practical assessment should provide a scoped view of critical assets and dependencies, a prioritized risk register, an assessment of relevant controls, a remediation roadmap, and an executive summary of decisions required.
Souldigi’s proposed cybersecurity engagement starts with scope and authorization, then proceeds to agreed assessment or testing, documented findings, and remediation guidance. Specific activities must be confirmed against actual team capability and client requirements before being offered.
Sources and further reading
NIST Cybersecurity Framework 2.0: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
NIST CSF FAQs: https://www.nist.gov/cyberframework/faqs
