Skip to content
Book a risk assessment

Groundwork.

Know your real risk in 5 business days.

A risk assessment of your business, built on NIST CSF 2.0. One questionnaire, one workshop and a walkthrough. No agents to install and no access needed to start.

Price
From $1,490, fixed
Your time
Under 4 hours, in total
The report
Yours, whatever you decide
Book Groundwork See what you get
Groundwork reportExample · Northbank Advisory
Overall maturity
1.8of 5
Target
3.5
Govern1.6
Identify2.2
Protect2.6
Detect1.2
Respond1.4
Recover2.0
TodayTarget
R-01 Account takeoverHigh
R-02 Ransomware on laptopsHigh
R-03 Client data leavingMedium
How it runs

Five business days, start to finish.

You spend under four hours on it. Everything else is ours, and every day has a clear output.

  1. Day 1
    Questionnaire and workshop
    You
    Fill in the questionnaire, then join a 90-minute workshop.
    Us
    Run the workshop and capture how your business really works.
    Your time · 2 h 15 min
  2. Day 2
    Crown jewels mapped
    You
    Confirm the list we send you.
    Us
    Map each crown jewel to where it lives and who else holds it.
    Your time · 10 min
  3. Day 3
    Impact and maturity
    You
    Rate four impact scenarios.
    Us
    Score your maturity across the six NIST CSF 2.0 functions.
    Your time · 15 min
  4. Day 4
    Risks and roadmap
    You
    Nothing.
    Us
    Rate every risk, build the roadmap and match packs to risks. An engineer checks every rating.
    Your time · none
  5. Day 5
    Walkthrough
    You
    A one-hour walkthrough with whoever owns the decisions.
    Us
    Explain every risk, what to fix first and what can wait.
    Your time · 60 min
3 h 40 min of your time, in total. The questionnaire takes about 45 minutes. Optional: grant read-only access and we pull your asset list instead of asking you to type it.
What we look at

Six functions. Questions about your business, not a compliance checklist.

NIST CSF 2.0 gives the structure. These are the kinds of questions we ask inside it.

GV

Govern

  • Who decides how much security risk the business will accept?
  • Do your supplier contracts say anything about security?
ID

Identify

  • Which systems couldn't you trade without for a week?
  • Which of them hold personal information, and whose?
PR

Protect

  • Can anyone sign in to email without a second factor?
  • Who has admin rights, and do they use them for everyday work?
DE

Detect

  • Would you know if someone signed in to your finance mailbox from overseas tonight?
  • Who looks at security alerts, and when?
RS

Respond

  • Who do you call first if ransomware hits on a Friday night?
  • Do you know which breaches you must report, and by when?
RC

Recover

  • When did you last restore a backup, end to end?
  • How long could the business run if your main system was down?
Crown jewels

What you couldn't trade without, and where it actually lives.

Most businesses can name their crown jewels. Far fewer know where each one sits, or who else holds the keys.

Example · Northbank Advisory · 8 crown jewels Severe impact Major Moderate
Cloud
Storage and email you rent
  • Client filesPersonal info
  • Email and calendarsPersonal info
SaaS
Software you log in to
  • Accounting systemPayments
  • Practice managementPersonal info
On-premises
Hardware in your office
  • Archive file serverPersonal info
Suppliers
Companies holding your data or keys
  • Managed IT providerAdmin access
  • Payroll providerPersonal info
  • Document scanning bureauPersonal info
Your managed IT provider holds admin access to everything, which makes them a crown jewel too. Groundwork finds dependencies like this before an attacker does.
Risk

Your impact ratings set the scale.

The same risk scores differently in a clinic and a law firm. You rate how much four things would hurt. We rate how likely each risk is.

You rate · Example
  • A large data leakSevere
  • An outage under 24 hoursModerate
  • An outage over 24 hoursMajor
  • A regulatory breachMajor
Your risk map · ExampleImpact by likelihood
Severe R-03R-05 R-02 Major R-04 R-01 Moderate R-06 Minor R-07 Minimal Rare Unlikely Possible Likely Almost certain
  • R-01 Account takeoverHigh
  • R-02 Ransomware on laptopsHigh
  • R-03 Client data leavingMedium
  • R-04 Fake invoice paidMedium
  • R-05 IT provider compromisedMedium
  • R-06 Backup can't be restoredMedium
  • R-07 Physical access to the officeLow
What you get

A plan you can act on on Monday, not a PDF for the drawer.

Five things, all yours whether or not you buy anything else from us.

  1. 01
    Risk register
    Every risk with a current and target rating, an owner and a treatment.
  2. 02
    Maturity score
    Current and target across the six NIST CSF 2.0 functions.
  3. 03
    90-day roadmap
    Tasks across people, process and technology, in the order that cuts the most risk.
  4. 04
    Recommended packs
    Each tied to the risks it reduces, plus what can wait.
  5. 05
    Your first Known Normal
    Who's who and what's where. It's what every alert is later judged against.
90-day roadmap · Northbank AdvisoryExample
W1W2W3W4W5W6W7W8W9W10W11W12W13 People Habits rolled out to all staff Phishing basics completed Process Access control policy approved Call-back check for bank changes Security clauses in supplier contracts Incident response plan tested Technology MFA for everyone Separate admin accounts Endpoint protection on every device Backups restore-tested
Price

One fixed price, sized by people.

No day rates and no extras. The price covers the questionnaire, the workshop, the analysis, the report and the walkthrough.

Groundwork, ex taxFixed price
Up to 50 people$1,490
51 to 150 people$2,235
151 to 300 people$2,980
301 to 500 people$3,725
Over 500 peopleWe'll price it with you

Five days from now, you'll know exactly where you stand.

Book Groundwork and we'll send the questionnaire within one business day.

Book Groundwork