Product · Cyber Risk Assessment
Annual Security Review and Risk Assessment
CyberAssess™ is Cyber Defense Advisors' annual security review and risk assessment. Each year it re-rates all 106 NIST CSF 2.0 subcategories on the same scale as the baseline, independently verifies last year's remediation, recalculates FAIR loss exposure, and delivers a refreshed risk register and twelve-month roadmap.
CyberAssess is the annual cycle that keeps a security program current. It re-runs the same assessment that established your baseline — all 106 NIST CSF 2.0 subcategories, six-level CMMI-aligned maturity scoring, FAIR exposure modeling — and measures what actually moved since last year.
SecureStart establishes the baseline. CyberAssess keeps it honest: remediation verified rather than assumed, the risk register refreshed, the roadmap rebuilt for the next twelve months, and current evidence on hand when an insurer, a customer or the board asks.
Scope
The full assessment re-run against a changed environment, plus the three things a baseline assessment cannot give you: verified progress, trend, and a refreshed plan.
All 106 subcategories re-rated across Govern, Identify, Protect, Detect, Respond and Recover — same method, same scale, comparable results.
Year-over-year movement by Function and subcategory, so progress is measurable rather than asserted.
Independent verification of what last year's roadmap actually closed, what partially closed, and what reopened.
Organizational, technical and operational risks re-identified and re-scored, with new entries for what changed during the year.
FAIR annualized loss exposure recalculated, so the dollar figure in front of the board reflects the current environment.
Changes in the critical vendor set and in AI tooling adopted during the year, assessed as part of the cycle.
Current assessment, scorecard and roadmap packaged for insurers, enterprise customers and auditors who ask for a recent independent review.
A live session on what moved, what did not, and what to fund next.
Deliverables
All 106 subcategories rated, with the prior year shown alongside.
What closed, what did not, and what reopened.
Re-scored, with remediation recommendations and named owners.
FAIR annualized loss exposure recalculated against the current environment.
Costed and sequenced, carrying forward what remains open.
Delivered live, plus a reusable briefing pack.
Delivery approach
Re-scope against what changed: systems, vendors, people, acquisitions, AI adoption.
Days 1–3
Structured interviews and evidence review across all six Functions.
Days 4–10
Independent verification of prior-year remediation; maturity delta and FAIR update.
Days 11–15
Report build, QA, named-assessor sign-off, executive and board readout.
Days 16–21
Elective quarterly check-ins, remediation oversight and roadmap tracking between cycles.
Elective
Timeline. Three to four weeks per cycle, run annually. Most clients anchor the cycle to an insurance renewal or board calendar. Elective quarterly check-ins keep the roadmap current in between.
| Standard / authority | Applied to |
|---|---|
| NIST CSF 2.0 | Assessment spine — all 106 subcategories across the six Functions |
| CMMI-aligned maturity model | Six-level scoring, held constant year over year for comparability |
| FAIR (Factor Analysis of Information Risk) | Annualized loss exposure and scenario modeling |
| ISO 31000:2018 | Risk criteria, scoring and treatment |
| NIST SP 800-53 Rev. 5; ISO/IEC 27001:2022 | Control reference and certification crosswalk |
| NIST AI RMF 1.0 | AI tooling adopted during the review period |
Responsible AI
Every rating, every dollar figure and every validation decision is reviewed and signed by a named CDA assessor. Client data is not used to train external models.
Why CDA
The same method and the same scale every year, so the board sees a trend line instead of four unrelated assessments.
Remediation is confirmed closed by someone who did not do the remediation — which is what an insurer or auditor is actually asking for.
Each cycle updates the plan rather than starting a new one, so open items stay visible until they close.
The baseline is already built. Recurring cycles cost less than first-year work while producing the same evidence.
Organizations that have already established a security baseline and need to keep it current — typically 50 to 1,000 employees in regulated or contract-driven sectors, with annual insurance, audit or customer-review obligations and no internal capacity to run an independent assessment. Also available as the annual risk assessment attached to a CyberComply subscription.
Non-invasive and evidence-based; penetration testing and other intrusive work is scoped separately through CyberRecon. Evidence is held under NDA in CDA's environment. AI-assisted analysis is reviewed and signed by a named CDA assessor; client data is not used to train external models. Not a certification or audit opinion.
Fixed-fee, scoped to your environment · 833-54-CYBER (833-542-9237)