Cybersecurity Assessments
Frequently Asked Questions
Answers to questions general counsel, CISOs, and audit committees ask about Law & Forensics' cybersecurity assessment practice — regulatory, framework-based, and risk-driven evaluations across HIPAA, NY DFS, FFIEC, CFATS, CCPA, and vendor due diligence. If your situation isn't addressed below, contact us for a confidential consultation.
Cybersecurity Assessments
What our assessments cover, when to use which framework, how privilege is preserved, and how the deliverables hold up before regulators and in litigation.
What is a cybersecurity assessment, and how does it differ from a penetration test or audit?
A cybersecurity assessment is a structured evaluation of your security program against a regulatory or framework benchmark — controls, policies, technologies, governance, and incident readiness.
A penetration test probes a specific environment for exploitable vulnerabilities; an audit verifies compliance after the fact. An assessment is broader and forward-looking — it tells you where the gaps are, why they matter, and what to fix first. Most regulators (HHS OCR, NY DFS, FFIEC examiners) expect documented assessments at least annually.
Which cybersecurity assessment is right for my organization?
Start with the regulatory regime that applies to you, then layer in a control framework that satisfies any contractual or insurance requirements.
Healthcare organizations need a HIPAA Security Rule risk analysis. New York-licensed financial institutions need a 23 NYCRR 500 assessment. Banks and credit unions need an FFIEC CAT assessment. Chemical facilities need CFATS. Businesses processing California consumer data need CCPA. We help you stack these into a single program.
Which cybersecurity frameworks do you map to in an assessment?
Most often NIST CSF 2.0, NIST 800-53, NIST 800-171, ISO/IEC 27001, CIS Controls v8, and CMMC for defense contractors.
For privacy-driven assessments we also map to NIST Privacy Framework and ISO/IEC 27701. Where a client has overlapping obligations, we build a unified control matrix so a single set of controls satisfies all applicable requirements — eliminating duplicate work for compliance, audit, and security teams.
What deliverables do we get from a cybersecurity assessment?
An executive summary suitable for the board, a detailed control-by-control findings report, a prioritized remediation roadmap with effort and cost estimates, and an evidence appendix.
Where the engagement is structured under counsel, the deliverable is a privileged work product addressed to your legal team. We also provide regulator-ready summaries for HHS OCR, NY DFS, or FFIEC examiners on request.
How do you protect attorney-client privilege over the assessment work product?
We engage under your in-house or outside counsel, scope the work in a Kovel-style engagement letter, and deliver findings to counsel rather than to operations.
This structure follows the Capital One, Wengui, and Rutter's line of cases — assessments performed in anticipation of litigation, with clearly labeled privileged work product flowing through counsel, are far more likely to be protected from discovery in a downstream class action or regulator investigation.
How often should we perform a cybersecurity assessment?
At least annually, and after any material change — a merger, a new product launch, a major cloud migration, or a significant incident.
NY DFS Part 500 explicitly requires annual risk assessments. HIPAA requires periodic risk analysis with the cadence calibrated to changes in the environment. NIST CSF 2.0 treats the assessment cycle as continuous rather than point-in-time. We offer continuous-monitoring options for clients with rapidly evolving environments.
How long does a cybersecurity assessment take, and what does it cost?
Most regulatory assessments run 4–10 weeks from kickoff to final report and are delivered on a fixed-fee basis.
Smaller, single-framework assessments (e.g., a CCPA privacy and cybersecurity check for a mid-market SaaS company) finish in 4–6 weeks. Multi-framework, multi-entity assessments for large enterprises run 8–12 weeks. We provide a written scope, timeline, and fee before any work begins.