Security risk assessment, documented and fixed.
A Cognivus security risk assessment identifies what could go wrong with the systems that hold your sensitive data, rates each risk by likelihood and impact using NIST SP 800-30, and gives you a prioritised plan to reduce it. If you want, we then implement the fixes.
Who it is for
Teams that hold customer, health or financial data and need to:
- know their real security risk before an investor, customer or regulator asks
- answer a customer's security questionnaire with evidence
- prepare for the HIPAA Security Rule, ISO/IEC 27001 or India's DPDP Act
Method
We follow NIST SP 800-30 Rev. 1 (Guide for Conducting Risk Assessments): prepare, conduct, communicate and maintain. For health data we apply NIST SP 800-66 Rev. 2, the HIPAA Security Rule implementation guide.
- Scope and inventory: systems, data flows, vendors and owners
- Threats and vulnerabilities: from configuration review, interviews and documentation
- Likelihood and impact: rated on a five-level qualitative scale, each with a written rationale and evidence reference
- Risk register and remediation plan: sequenced by risk and effort, with owners and target dates
Remediation, if you want it
We implement the fixes: access controls, MFA, encryption, logging, backups, policies and staff training. Then we update the risk register so you can show the change.
Typical duration: 3–5 weeks for the assessment. Remediation is scoped separately.
What it is not
A risk assessment is not a certification and not legal advice, and it is not a substitute for hands-on security testing of a specific system. Every report says plainly what it does and does not cover, because overstated reports fail the first serious review.
Frequently asked questions
Do you need access to our customer or patient data?
Usually not. We work from configurations, diagrams and redacted samples.
Is this a penetration test?
No. A risk assessment reviews your whole system of controls, people and vendors; security testing probes a specific application for exploitable weaknesses. They answer different questions, and we offer both. Many teams start with the risk assessment.
Can I see an example report?
Yes. Our sample report for a fictional digital-health company shows the full structure, scoring, risk register and remediation plan.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.