Risk Assessment

Risk Assessment

A security risk could have a negative impact on your organization's image, revenues, ability to meet deadlines, or accomplish an objective.

Altius IT's risk management services provide a top down approach to security:

• Risk assessment – Our experts identify your assets and threats to the assets.
• Risk analysis – We identify the likelihood of the event and impact on your organization.
• Risk treatment – We identify preventive, detective, and corrective controls that reduce risks to acceptable levels. We identify gaps and safeguards that need to be implemented.

Risk Assessments We Perform

That method is applied to whichever standard you are answerable to. These are the named engagements clients most often ask for by name.

• HIPAA Security Risk Analysis (SRA) – the risk analysis required at 164.308(a)(1)(ii)(A), which is the most frequently cited deficiency in OCR enforcement. It is its own engagement, not a section of a Security Rule audit.
• NIST CSF 2.0 maturity assessment – your current and target tier across all six functions, Govern included, with the distance between them written up as a prioritized plan rather than a score you cannot act on.
• AI governance audit – the risk, bias, transparency, and security controls around the AI your organization builds or buys, covered in depth in our AI governance audit.
• Third-party vendor risk assessment – the security posture of the vendors and partners who hold your data or reach your systems. Covered below, and in depth on its own page.

Also ADMT and automated decision-making risk, CCPA privacy risk assessments, multi-state data protection reviews, CIS Controls v8.1, and COBIT.

NIST CSF 2.0 Maturity Assessment

The Cybersecurity Framework is the most common way a board, an insurer, or a customer asks how mature your security actually is, because it gives an answer that does not depend on your industry or your tooling. Version 2.0, published in February 2024, restructured it around six functions rather than the five most people still quote:

• Govern – the function added in 2.0, and the one most organizations score worst on. Who owns security risk, how it is escalated, what the board sees, and how policy, roles, and supply chain expectations are actually set rather than assumed.
• Identify – asset, data, and supplier inventories, and whether you know what you are defending before you defend it.
• Protect – identity and access management, awareness, data security, and platform and infrastructure resilience.
• Detect – whether adverse events are found, and how quickly, rather than whether a tool is installed.
• Respond – incident management, analysis, reporting, and containment once something is found.
• Recover – restoration and communication, measured against real objectives in our ransomware readiness audit.

We score your current tier and the target tier your business case actually needs, which is rarely the highest one, and write the distance between them up as a sequenced plan. The framework is voluntary, so the value is not a certificate; it is a common vocabulary you can hand to a board or a customer that maps cleanly onto HIPAA, ISO 27001, and PCI DSS work you may already be doing.

Third-Party Vendor Risk Assessment

Your vendors' risk is your risk, and it is the part of your attack surface you do not administer. A vendor with access to your systems or your data extends your perimeter to their controls, their staff, and their own subcontractors, and a breach at their end is still a breach you have to notify.

We assess the administrative, technical, and physical safeguards of your critical vendors and business partners independently, rather than accepting a completed questionnaire at face value, and we look through to fourth-party dependencies where a vendor has outsourced the thing you are relying on them for. Where you need a vendor's SOC 2 report reviewed rather than trusted, that is part of the same engagement.

This is a full service in its own right, with vendor tiering, due diligence, contract security terms, and ongoing monitoring. See our third-party vendor risk management page for the complete scope.

HIPAA Is Three Engagements, Not One

The Security Risk Analysis above is a requirement in its own right. The Security Rule audit of your safeguards is part of our compliance audit, and the Privacy Rule audit of how PHI may be used and disclosed is part of our privacy audit. A regulator asking for your risk analysis will not accept either of the other two in its place.