Framework assessments

Practical guides for consultants and vCISO teams assessing clients against a security framework: what the framework asks for, what evidence to request, and how to reuse that evidence across frameworks.

• CPCSC readiness assessments for consultants

  What CPCSC Levels 1, 2 and 3 require, the 13 Level 1 controls and the evidence that supports them, and how consultants prepare defence suppliers for Level 2 certification.

• Évaluations de préparation au PCCC pour les consultants

  Ce qu’exigent les niveaux 1, 2 et 3 du Programme canadien de certification en cybersécurité (PCCC), les 13 contrôles du niveau 1 et les éléments probants à demander, et comment préparer un fournisseur de la défense au niveau 2.

• ISO 27001 gap assessments for consultants

  How consultants run an ISO/IEC 27001:2022 gap assessment across clauses 4 to 10 and the 93 Annex A controls, what evidence to request, and how to deliver a readiness report the client can act on.

• NIST CSF 2.0 maturity assessments

  How to assess a client against NIST CSF 2.0's six functions, why the framework has no built-in maturity scale, and a practical 0 to 5 scoring rubric that ties each score to evidence.

• CIS Controls v8.1 assessments for consultants

  How consultants assess clients against the 18 CIS Controls and 153 Safeguards in v8.1, how to pick the right Implementation Group, and how to turn Safeguard results into a prioritized roadmap.

• SOC 2 readiness assessments for consultants

  How consultants prepare clients for a SOC 2 examination, from choosing Trust Services Criteria to testing evidence for a Type II period, and where the consultant's role ends and the CPA firm's begins.

• TPN assessment readiness for media and entertainment vendors

  How consultants prepare media and entertainment vendors for a Trusted Partner Network assessment, what each TPN Shield requires, and how to scope Site, Cloud and Application assessments.

• Reusing evidence across ISO 27001, NIST CSF, CIS Controls, SOC 2 and CPCSC

  How one piece of client evidence can support related controls in ISO 27001, NIST CSF 2.0, CIS Controls v8.1, SOC 2 and CPCSC, with a worked crosswalk and the limits of reuse.