Know which risks matter most to your organization, and what it would take to bring each one down to a level you can accept. Independent risk assessments by CISA-certified auditors.
Get Your QuoteNot every gap deserves the same attention. A risk assessment tells you which threats could actually hurt your revenue, reputation, or operations, so you spend on the controls that matter first.
Our certified auditors take a top-down approach, starting with what your organization cannot afford to lose and working down to the controls that protect it. Our method follows NIST SP 800-30, the federal guide for conducting risk assessments, and ISO/IEC 27005 for organizations working under ISO 27001.
That method is applied to whichever standard you are answerable to. These are the named engagements clients most often ask for by name.
Also ADMT and automated decision-making risk, CCPA privacy risk assessments, multi-state data protection reviews, CIS Controls v8.1, and COBIT.
The Cybersecurity Framework is how a board, an insurer, or a customer most often asks how mature your security is. We score your current and target maturity across all six CSF 2.0 functions, Govern included, and write the gap between them up as a sequenced plan. It is available in three tiers, including a free self-assessment, and maps cleanly onto HIPAA, ISO 27001, and PCI DSS work you may already be doing.
For federal agencies and contractors working under NIST SP 800-37, the Risk Management Framework, risk assessment is not a one-time exercise. It informs how each system is categorized and which controls are selected and tailored, and it is updated as systems and threats change. We perform the NIST SP 800-30 risk assessment that feeds those steps, and the independent NIST SP 800-53A control assessment for the assess step. The authorization decision itself stays with your authorizing official.
Your vendors' risk is your risk, and it is the part of your attack surface you do not administer. A vendor with access to your systems or your data extends your perimeter to their controls, their staff, and their own subcontractors, and a breach at their end is still a breach you have to notify.
We assess the administrative, technical, and physical safeguards of your critical vendors and business partners independently, rather than accepting a completed questionnaire at face value, and we look through to fourth-party dependencies where a vendor has outsourced the thing you are relying on them for. Where you need a vendor's SOC 2 report reviewed rather than trusted, that is part of the same engagement.
This is a full service in its own right, with vendor tiering, due diligence, contract security terms, and ongoing monitoring. See our third-party vendor risk management page for the complete scope.
The Security Risk Analysis above is required by the Security Rule and performed as its own engagement. The Security Rule audit of your safeguards is part of our compliance audit, and the Privacy Rule audit of how PHI may be used and disclosed is part of our privacy audit. A regulator asking for your risk analysis will not accept either of the other two in its place. Our HIPAA compliance audit page sets out all three side by side if you are working out which ones apply to you.
Each risk we identify is rated for how likely it is and how much it would hurt. The top right is where your budget should go first.
A prioritized risk register with each risk rated for likelihood and impact, the controls that would reduce it, and the steps to get there. After delivery, Altius IT provides three months of free support to answer your questions.
Altius IT provides a certified auditor with each engagement:
Our proposal provides you with detailed information so you know exactly how we will help you:
Three phases that start with what your organization cannot afford to lose.
We work with your stakeholders to identify the systems, data, and processes the business depends on, and the threats that could disrupt them, from ransomware and vendor breaches to human error and outages. You receive a detailed proposal covering scope, pricing options, team CVs, and sample reports.
For each threat we review the safeguards in place, then rate how likely it is to occur and how much it would cost in revenue, reputation, and operations. The result is a ranked view of risk, not a flat list of gaps.
You receive a risk register and a plan that recommends preventive, detective, and corrective controls for each risk, ordered by the reduction they buy. We walk leadership through the results and provide three months of free post-audit support.
Almost every security framework requires a current risk assessment, and it is one of the first documents an auditor or examiner asks for.
| Healthcare & Business Associates | The HIPAA Security Risk Analysis is required, and it is one of the deficiencies OCR cites most often. |
| Financial Institutions | The GLBA Safeguards Rule and NY DFS Part 500 both require a written risk assessment. |
| Organizations Under ISO 27001 or NIST | Both frameworks build on a documented risk assessment and treatment plan. |
| Boards & Executives | Leaders deciding where to invest, who need risk ranked by business impact rather than listed by technology. |
| Federal Agencies & Contractors | Systems managed under the NIST Risk Management Framework, where risk assessment informs categorization and control selection. |
| After a Major Change | A merger, a new system, a move to the cloud, or a new vendor that holds sensitive data. |
An audit measures your controls against a standard and reports where they fall short. A risk assessment starts from what could go wrong, rates each threat by likelihood and impact, and tells you which risks to address first and which controls would reduce them most.
No. The Security Risk Analysis is required by the Security Rule, but it is a different engagement from an audit of your safeguards. A regulator asking for your risk analysis will not accept a Security Rule audit in its place. Our HIPAA compliance audit page explains how the pieces fit.
At least annually, and whenever something significant changes, such as a new system, a merger, a move to the cloud, or a new vendor that holds sensitive data. Many frameworks, including the GLBA Safeguards Rule, expect it to be kept current.
A risk register that rates each risk for likelihood and impact, a recommendation for how to treat each one, and a prioritized plan of controls, written so leadership can make investment decisions from it.
Our risk assessments follow NIST SP 800-30, the federal guide for conducting risk assessments, and ISO/IEC 27005 for organizations working under ISO 27001. For systems under the NIST Risk Management Framework (SP 800-37), the assessment is written to inform categorization and control selection, and it maps to the HIPAA, GLBA, and NY DFS requirements that apply to you.
Unlike a security consultant, Altius IT is certified as a Certified Information Systems Auditor to perform a security audit of your environment and issue reports and recommendations to secure your systems. Altius IT has been featured in 40+ publications and nationwide media outlets.
Strengthen your applications and network infrastructure against evolving threats.
Meet HIPAA, GDPR, NIST, ISO, PCI-DSS, SOX, and other compliance standards.
Safeguard sensitive data, intellectual property, and customer information.
Every engagement includes follow-up support to ensure vulnerabilities are properly mitigated.
