How to prepare for a security assessment

Start with an operational question

An assessment becomes easier to manage when it answers a specific question. A water district general manager might ask whether staff can continue essential administrative work during an email outage. A nonprofit leader might ask who can access participant records after a volunteer leaves. Write the question in ordinary language, then identify the people who can explain the process from beginning to end.

NIST provides Current and Target Profile templates for comparing cybersecurity outcomes and identifying gaps. That structure can help organize discussion, but the assessment still needs a defined purpose. Decide whether the immediate output is a budget recommendation, an access cleanup plan, a recovery improvement plan, or a broader baseline. Avoid treating every possible security topic as equally urgent.

Define the boundaries before testing

List the systems, locations, applications, and suppliers included in the review. Identify exclusions explicitly. If operational technology supports physical processes, distinguish interviews and document review from technical testing. A conversation about a control system does not authorize scanning it. The assessment owner should approve the methods, access arrangements, timing, and escalation contact before any active testing begins.

Ask how the assessor will handle sensitive records and whether screenshots can be redacted. Establish a secure exchange method and an agreed retention approach. Give reviewers the minimum access needed for the stated work. Staff should know whom to contact if a request appears broader than the scope or could interfere with service delivery.

Collect evidence that already exists

Start with an application list, an account inventory, recent backup test records, incident contacts, relevant provider agreements, and existing security policies. Include the date and owner of each item. A current configuration export may answer a question more accurately than an old policy. Label missing or incomplete evidence honestly so the reviewer can distinguish an unknown from a confirmed weakness.

Schedule short conversations with finance, operations, human resources, and the IT provider. Each sees different dependencies. Finance may know who approves payment changes; operations may know which vendor retains remote access. Do not assemble sensitive records merely to make a folder look complete. Ask what fact the reviewer needs and whether a limited sample can establish it.

Agree on the format of findings

Request findings that separate the observation, its evidence, the plausible operational consequence, and the recommended next step. Ask for uncertainty to be stated. An account with an unfamiliar name needs investigation before anyone calls it unauthorized. A missing restoration record means recovery capability has not been demonstrated by that record; it does not establish that recovery is impossible.

Illustrative example: an assessor finds that a former contractor still appears in a billing application. The useful next step is to confirm the contract status with the application owner, inspect effective permissions, and remove or narrow access through an approved change. The finding should identify who verifies the result. This example describes a planning approach, not a client engagement.

Reserve time for decisions and follow-through

Before the final meeting, identify who can approve spending, assign work, and accept a temporary exception. Ask the assessor to distinguish immediate containment needs from longer improvements. For each selected action, record an owner, a target date, dependencies, and the evidence that will show completion. Put unresolved questions on the same list so they do not disappear between meetings.

A security assessment is useful when it improves a decision and creates work the organization can sustain. Review the proposed scope against the security assessment service at Security Assessment if outside help is appropriate. Keep the operational question visible through the final readout, and schedule a follow-up to examine completed changes rather than only counting closed findings.

Sources and further reading

• NIST: CSF 2.0 organizational profiles

This field note is general educational guidance. Your organization’s requirements, scope, and service arrangements determine the work that applies.