How to Run a Security Posture Assessment in 30 Days

A security posture assessment tells you how well protected your organization is right now: what you have, who can reach it, which controls exist and whether they actually work. You can run a useful one in 30 days if you keep the scope tight and follow a fixed sequence. Spend the first week on scope and inventory, the second reviewing controls against a framework such as NIST CSF 1.1 or CIS Controls v8, and the third validating those controls with technical testing. Use the last stretch to turn findings into a prioritized roadmap. Below is the plan we use, week by week.

What is a security posture assessment?

A posture assessment is broad by design. It covers your controls end to end, tests enough to confirm what people tell you, and finishes with a plan. It isn't a compliance audit and it isn't a penetration test, although it borrows from both.

By the end, leadership should have clear answers to three questions. What do we have and what matters most? How well are we protecting it today? What should we fix first, and what will it cost?

Why run it in 30 days?

Thirty days is long enough to gather real evidence and short enough to keep people engaged. Assessments that drift into a third month tend to lose their sponsor, and early findings go stale. A fixed timebox also forces you to decide which systems matter most, which is itself part of understanding your posture.

Week 1: Scope, stakeholders and ground rules

Set the scope

Decide what's in and write down what's out. For a first assessment we recommend covering the whole organization at moderate depth, because a broad view surfaces the gaps that cut across everything, such as identity and logging. Be explicit about cloud accounts, SaaS applications and anything run by a managed service provider, since these are most often left out by accident.

Choose a framework

Pick one framework as your scoring model so the results are consistent and repeatable.

• NIST Cybersecurity Framework 1.1 organizes outcomes into five Functions: Identify, Protect, Detect, Respond and Recover. It's outcome-based and easy to explain to leadership. Its idea of a Current Profile and a Target Profile maps neatly onto an assessment and a roadmap.
• CIS Controls v8 has 18 Controls broken into specific Safeguards and grouped into Implementation Groups. Implementation Group 1 (IG1) is 56 Safeguards that CIS describes as essential cyber hygiene. The Controls are more prescriptive, which makes them easier to test.

A practical approach for mid-sized organizations is to assess against CIS Controls v8 IG1 and IG2, then roll the results up to the five CSF Functions for the executive summary. The NIST CSF 1.1 document sets out the Functions, Categories and Subcategories you'll map to.

Name the stakeholders

You'll need time from people outside IT security, so book it in week one:

• An executive sponsor who will receive the results and fund the roadmap
• Infrastructure, identity and cloud platform owners
• Owners of the three to five most important business applications
• HR, for joiner, mover and leaver processes
• Any managed service provider that administers part of your environment

Agree on rules of engagement

Week three involves scanning and configuration checks. Get written authorization now covering address ranges, tools, time windows and who to call if something misbehaves. If a provider hosts any of your systems, check whether they require notice before you scan.

Request documents early

Ask for policies, network diagrams, previous audit and test reports, SaaS and cloud account lists, backup procedures and the incident response plan. Missing documents are a finding in their own right.

Weeks 1–2: Build the asset, identity and data inventory

Every later step depends on knowing what's there. Start the inventory in week one and finish it early in week two.

Assets

Pull asset lists from several sources and reconcile them: the directory, endpoint management, DHCP and DNS records, virtualization platforms, cloud consoles and a discovery scan. Where the sources disagree, you've found something worth investigating.

Pay special attention to what's reachable from the internet, including public IP addresses, remote access gateways, web applications and cloud resources with public endpoints.

Identities

List every account, not just employees. That includes contractors, service accounts, shared accounts, administrator accounts, cloud identities and roles, and the admin accounts inside SaaS applications.

For each, record whether it has administrative rights, whether MFA is enforced and when it last signed in. CIS Safeguard 5.3 uses 45 days of inactivity as the point to disable dormant accounts, which gives you a reasonable threshold. Accounts belonging to people who have left are a common and serious finding.

Data

You don't need a full data classification program for this. Identify your ten or so most important data stores, who owns each one, where it lives and who can access it. Include file shares and cloud storage, not just databases, because that's where sensitive data tends to spread.

Week 2: Review controls against the framework

With inventories in hand, work through the framework one area at a time. Interview the owner, collect evidence and score each control.

A simple scale works well:

1. Not in place. No control exists.
2. Partial. It exists but doesn't cover everything in scope.
3. In place. It exists, covers the scope and has evidence behind it.
4. Verified. Confirmed by your own technical testing in week three.

Keep a clear line between what people say and what they can show. Ask to see the last backup restore test rather than asking whether backups are tested. Ask for the access review record rather than asking whether access is reviewed.

If you're using CIS Controls v8, these areas deserve the most attention in a first assessment:

• Enterprise asset and software inventory (Controls 1 and 2)
• Data protection (Control 3)
• Secure configuration (Control 4)
• Account and access control management (Controls 5 and 6)
• Continuous vulnerability management (Control 7)
• Audit log management (Control 8)
• Data recovery (Control 11)
• Service provider management (Control 15)
• Incident response management (Control 17)

Service providers are easy to skip. List every vendor with remote access or custody of your data, and check how that access is granted and removed.

Week 3: Validate with technical testing

Interviews tell you how things are supposed to work. Testing tells you how they do work, so use this week to confirm or disprove the week-two scores.

Vulnerability scanning

Run an external scan of your internet-facing assets and an authenticated internal scan of servers plus a sample of workstations. Authenticated scans find far more than unauthenticated ones because they can see installed software and missing patches.

Don't treat every finding equally. Cross-check results against CISA's Known Exploited Vulnerabilities catalog, and give the most weight to exploited vulnerabilities on systems reachable from the internet. Flag any operating system or application that's past end of support.

Configuration review

Compare a sample of systems against CIS Benchmarks or your own hardening baseline. Look for default credentials, users with local administrator rights, disabled disk encryption, unnecessary services and missing host firewall rules.

In cloud environments, check for storage that's publicly accessible, security groups or firewall rules that expose management ports to any address, use of the root or top-level owner account for daily work, and audit logging that's turned off in some accounts or regions.

Identity and MFA coverage

Compare your authentication configuration against the account inventory from week one. Calculate MFA coverage as a percentage for all users, then separately for privileged accounts, remote access, email and cloud consoles. The privileged number matters most.

Look closely at exceptions. Legacy authentication protocols, service accounts and old policy exclusions often create paths that skip MFA entirely.

Logging and detection spot checks

Pick a few events, such as a new account added to an admin group, and trace them to your central log store. Confirm they arrived, check retention and find out whether anyone was alerted.

Backup and recovery check

Ask for a restore of a sample file and, if time allows, a full system. Check whether the backups could be deleted or altered with the same administrator credentials used in production. If a single compromised admin account could wipe both your systems and your backups, that's a high-priority finding.

Week 4: Turn findings into a prioritized roadmap

Write findings people can act on

Each finding should state what you observed, the evidence, the risk in business terms, the recommended fix, a suggested owner and a rough effort estimate. Describe the specific gap. "MFA is not enforced on 14 of 22 administrator accounts" is useful. "MFA should be implemented" is not.

Prioritize

Rate each finding on likelihood and impact, then weigh it against effort. Group the results into time horizons:

Present to leadership

Keep the executive summary to one or two pages: current versus target scores by CSF Function or CIS Control, the top five risks in plain language, the top ten actions with owners and dates, and the resources needed. Technical detail goes in an appendix.

Plan the re-check

Track roadmap items monthly and schedule a lighter re-assessment in six to twelve months against the same framework and scoring scale. Consistency is what lets you show progress.

Frequently asked questions

Should we use NIST CSF 1.1 or CIS Controls v8?

Use CIS Controls v8 if you want specific, testable Safeguards and a clear baseline through the Implementation Groups. Use NIST CSF if you need a structure that leadership and regulators already recognize. Many organizations assess against CIS and report against CSF.

Can we run the assessment ourselves?

Yes, if you have people with the time and enough independence to be candid about their own systems. A common middle path is to run the inventory and control review internally and bring in outside help for technical validation.

What if we find something serious partway through?

Don't wait for the report. If you find an exploitable internet-facing vulnerability, customer data in public storage or signs of account misuse, escalate it immediately through your incident response process.

How often should we repeat it?

A full assessment once a year works for most mid-sized organizations, with quarterly roadmap check-ins. Run an extra one after a major change, such as an acquisition or a large cloud migration.

Next steps

• Pick your framework and scoring scale this week.
• Name an executive sponsor and book stakeholder time for the next four weeks.
• Get written authorization for technical testing before week three.
• Start the inventories now, since everything else depends on them.