| A cyber security assessment reviews the security controls, systems and practices in an agreed scope and identifies gaps and improvement priorities. What you receive depends on the work commissioned, so the label alone is not enough to compare proposals. |
This guide is for New Zealand business owners and managers choosing a reviewer for a cyber security assessment. It explains what to agree before a cyber security assessment starts, how to compare proposals and how to turn findings into action.
For the method behind identifying and scoring business risks, see our cyber risk assessment guide. If you want a broader starting point across your IT environment, see our IT assessment page.
Which security review do you need?
Providers use assessment labels differently. Start with the decision you need to make. A security assessment can review gaps and improvement priorities. A risk assessment examines credible scenarios, their likelihood and business consequences. An audit checks controls against agreed criteria. A penetration test examines exploitable weaknesses within an authorised scope. These can inform each other, and there is no compulsory order.
| Review | The question it answers | What you might receive | When it fits |
|---|---|---|---|
| Cyber security assessment | Where are the gaps in our security, and what should we improve first? | Findings and improvement priorities for the agreed scope, with a risk register if the scope includes one. | You need a current picture of your controls to plan improvements. |
| Cyber risk assessment | Which scenarios could harm the business, how likely are they and what would the consequences be? | A risk register with likelihood, impact and possible consequences, and treatment decisions. | You need to decide which risks to treat, accept or transfer, or explain them to leadership. |
| IT security audit | Are the controls we rely on in place and working, measured against agreed criteria? | Findings against the criteria, with evidence, limitations and an optional maturity rating on a defined scale. | A customer, insurer, regulator or board needs evidence about specific controls. |
| Penetration test | Can the systems in scope be exploited using the techniques agreed? | Exploitable weaknesses found within the authorised scope, how they were found and how to fix them. | A launch, contract, change or specific exposure calls for testing particular systems. |
Testing first can be the right choice when a launch deadline, a contract or a specific exposure calls for it. A penetration test is bounded evidence about the systems and techniques examined on the day, not proof of everything a real attacker could reach. The UK National Cyber Security Centre’s penetration testing guidance describes testing as a check on how well vulnerability management is working rather than the main way to find vulnerabilities.
Agree the question, the scope and the output before comparing cyber security assessment providers. Two proposals with the same label can describe different work, and a proposal with a different label may answer your question better.
What should you agree before the assessment starts?
Agree the following in writing before a cyber security assessment begins. The checklist is buying advice for comparing proposals, and the right level of detail depends on the size of the work.
| Agree in writing | What the proposal should identify |
|---|---|
| Purpose and audience | The decision being supported and any requirements from the report’s recipient. |
| Scope and exclusions | Named systems, sites, cloud services, suppliers and dependencies included or excluded. |
| Method and depth | Criteria, evidence, interviews, sampling, scans and any testing. |
| Access and authorisation | Approved access, testing limits, disruption arrangements and an urgent issue contact. |
| Outputs and limitations | Report content, walkthrough, unverified areas and optional scoring methods. |
| Fees and timetable | Assumptions, staff preparation, milestones, exclusions and approval of scope changes. |
| Follow-up and data handling | Who fixes and verifies findings, plus secure storage, access, retention and disposal. |
Which areas should a cyber security assessment cover?
Choose the areas from the decision you need to make and the way your business runs. Common areas include accounts and access, devices, email, network, cloud services, backups and recovery, suppliers with access to your systems, and staff practices. A business with remote staff, a clinic holding health information and a retailer taking card payments each face a different mix of cyber attacks, so the scope should reflect your real operations.
Where the cyber security assessment covers infrastructure, confirm how it will examine network security and endpoint security, whether by configuration review, evidence or scanning. For accounts, ask whether it will identify which logins still depend on a password alone and which could move to stronger methods such as passkeys.
Broad or narrow?
A broad cyber security assessment can be valid when the depth and resources match the areas covered. A narrow review can go deeper on the systems that matter most, but it needs its exclusions and dependencies recorded. A finding that a system is secure means little if the identity platform, supplier connection or backup it depends on was left out without anyone noticing.
If a provider proposes to leave an area out, ask why and record the reason. Leaving out backups, suppliers or staff practices may be reasonable for a narrow purpose, but the report should say so plainly.
Can your existing IT provider assess your security?
Your existing provider can carry out a useful cyber security assessment, but may be assessing its own work. Ask who will perform it, what evidence they will examine and whether they have a commercial interest in the recommended products or follow-up work.
The report should explain the findings, assumptions and priorities clearly enough for you to discuss them with another provider. If a customer, insurer or regulator requires independent assurance, confirm their criteria before choosing the reviewer. You may need someone independent of the systems or work being assessed.
An external reviewer is not automatically independent either. A product recommendation alone does not prove a poor review, and a different reviewer may reasonably weigh some priorities differently. Disclosure and reasoned findings are the standard to ask for.
Internal review or external reviewer?
Internal reviews can be useful for checking that agreed fixes have held and for keeping progress visible between external reviews. They use staff time, and the people reviewing may be checking work they did themselves. An external cyber security assessment adds a separate view and can examine areas your team has less experience with. Choose based on the purpose, the skills needed and whether someone outside the business requires a particular kind of reviewer.
How do you compare cyber security assessment providers?
Ask every shortlisted cyber security assessment provider the same questions, and compare the written answers against the checklist above.
- People. Who will perform the work, and what experience do they have with systems like yours?
- Method. Which criteria or framework will they use, what evidence will they examine and how will they sample?
- Tools. Which automated tools will they use, and how will a person review and interpret the results?
- Prioritisation. How will they rank findings, and will they explain the reasoning behind each priority?
- Reporting. Will there be a plain-language summary for leadership as well as detail for technical staff?
- Interests. Do they manage any systems in scope, or have an interest in products or follow-up work they may recommend?
- Data handling. How will they store, protect, share and dispose of the information they collect about your systems?
A cyber security assessment gathers sensitive detail about your weaknesses, so data handling deserves a clear answer. Ask where reports and evidence are stored, who can see them and when they are deleted.
Asking to see an example report with client details removed can help you judge whether the output would be useful, though some providers cannot share one. If not, ask them to describe the report structure and how a typical finding is written.
Warning signs in a proposal
- No written scope. The systems, exclusions and method are described only in general terms.
- Scan presented as a full review. An automated scan can be useful, but it is not the same as a reviewed assessment of your controls.
- Findings without reasoning. Priorities that are not explained cannot be checked or discussed with anyone else.
- Undisclosed interests. Recommendations for products or work the provider supplies, without saying so.
- Pressure to commit. Urgency to sign a longer contract before you have seen any findings.
A fixed price is not a warning sign by itself. A standard package can work where the inclusions, limits and assumptions are clear.
What does a cyber security assessment cost?
Cost depends on the systems and sites in scope, the depth of examination, available records and the reporting requirements. A fixed fee can be appropriate when the assumptions, inclusions and exclusions are clear. Ask how additional work is approved and charged.
Compare quotes against the same scope. Confirm whether the fee for the cyber security assessment includes a leadership summary, detailed findings, a walkthrough and follow-up verification. Remediation may be separate. Internal reviews also use staff time. Judge value by whether the work supports a useful decision and leads to agreed action, rather than by a promised return.
Identifying a gap does not fix it, and a gap that has not been exploited is not a measurable saving. A review is worth commissioning when it answers the question you need answered, at a depth that matches the decision.
What should a cyber security assessment report include?
Ask for a cyber security assessment report that includes:
- Summary. A plain-language overview for leadership of what was found and what needs a decision.
- Scope and method. What was examined, how, using which criteria, and when.
- Findings and evidence. Each finding, the evidence behind it and why it matters to the business.
- Limitations. Areas excluded, not verified or only sampled, and any assumptions made.
- Proposed actions. Recommended actions with priorities and the reasoning behind them.
A maturity score or complete risk register is not required for every type of cyber security assessment. If scoring is included, ask for its scale and the reasoning for each score. Agree who assigns business risk owners and who approves treatment decisions, rather than expecting a finished roadmap for every scope. A useful report also notes the controls that are working well, so you know what to keep.
When should you commission a cyber security assessment?
Common points to commission a cyber security assessment include before a significant change, such as moving systems to the cloud, opening a new site or changing provider. A cyber insurance renewal, a customer security questionnaire or a planning and budget cycle can also be useful prompts.
Agree the review cycle around your risks, changes and any customer, insurer or regulatory requirements. An annual review can be a useful planning baseline, but it is not a universal requirement. Review affected areas after significant system or supplier changes, incidents or newly identified exposures, and verify urgent fixes promptly rather than waiting for the next scheduled review.
After an incident, a review can help once the incident has been contained. It does not replace your incident response plan. If personal information was involved, the Privacy Commissioner explains when a privacy breach must be notified.
How do you act on the findings?
Confirm the findings with the people responsible for the systems. Agree priorities using business impact, exploitability, existing protection and any uncertainty. Assign an action owner and target date, and record who accepts any remaining risk. Verify that fixes worked before marking the work complete. A technical severity rating is one input to that decision.
Walk through the findings
Go through the report with the people who run the systems and correct any misunderstandings.
Agree priorities
Weigh business impact, exploitability, existing protection and uncertainty, not severity alone.
Assign owners and dates
Give each action a named owner and a target date, and record any risk the business accepts.
Fix and verify
Confirm each fix works before closing it, and retest where the finding was serious.
Track progress
Review open actions at an agreed interval and carry the results into budget and planning decisions.
Use the results of the cyber security assessment to inform your wider IT risk management decisions and your next budget round. Where a finding needs deeper evidence about a specific system, a focused penetration test may be the next step. NIST’s guide for conducting risk assessments describes how assessment results feed into decisions about responding to risk.
Cyber security assessment support from Exodesk
Exodesk can help you decide which review fits the decision you need to make and what to agree before the work starts. Our IT security audit reviews controls against agreed criteria, and our penetration testing examines exploitable weaknesses within an authorised scope. We agree the scope before we quote. If Exodesk manages any of the systems in scope, we tell you before the work starts, and where we recommend something we could supply, we say so. For a broader starting point, see our IT assessment.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. See our cyber security services for the reviews we run.
NEXT STEP
Discuss the security review you need
Tell us what you need to decide, which systems are involved and whether a customer, insurer or contract sets the requirements. We can discuss which review fits and what to agree before the work starts.
Or see our IT security audit service.
Frequently Asked Questions
What is the difference between a cyber security assessment, an audit and a penetration test?
Providers use these labels differently, so start with the decision you need to make. A cyber security assessment reviews gaps and improvement priorities in an agreed scope, an audit checks controls against agreed criteria and a penetration test examines exploitable weaknesses within an authorised scope. They can inform each other, and there is no compulsory order.
What should a good cyber security assessment deliver?
It should deliver findings and improvement priorities for the agreed scope, with the evidence and reasoning behind each one. A plain-language summary for leadership and the limitations of the work should be included. The exact outputs depend on what was commissioned, so agree them in writing first.
How do I choose a cyber security assessment provider?
Ask each provider who will do the work, what method and evidence they will use, how they prioritise findings and how they handle your data. Ask whether they manage any systems in scope or have an interest in products or work they may recommend. Compare the written answers against the same scope.
How should a cyber security assessment be scoped?
Agree the purpose, the systems, sites, cloud services and suppliers included or excluded, and the method and depth before work starts. Record exclusions and dependencies, access and testing limits, outputs, fees and follow-up. A narrow scope can go deeper, but it needs its exclusions stated plainly.
What are the warning signs of a weak cyber security assessment?
Warning signs include no written scope, an automated scan presented as a full review, findings without reasoning, undisclosed interests in recommended products and pressure to commit before seeing results. A fixed price is not a warning sign by itself when the inclusions and assumptions are clear.
Should I use an internal review or an external provider?
Internal reviews can check that fixes have held and keep progress visible, but they use staff time and may review work the same people did. An external review adds a separate view. If a customer, insurer or regulator requires independent assurance, confirm their criteria before choosing the reviewer.
What does a cyber security assessment cost in New Zealand?
Cost depends on the systems and sites in scope, the depth of examination, available records and the reporting required. A fixed fee can work when the assumptions and exclusions are clear. Compare quotes against the same scope and check whether a summary, walkthrough and follow-up verification are included.
How is this different from a cyber risk assessment?
This guide covers commissioning a review: the scope, the reviewer, the proposal and using the findings. A cyber risk assessment is a method that examines credible scenarios, their likelihood and their business consequences to support treatment decisions. Our cyber risk assessment guide explains that method.
What should the assessment report include?
Ask for a summary, the scope and method, findings with supporting evidence, limitations and proposed actions with the reasoning behind each priority. A maturity score or full risk register is optional, and if scoring is included its scale should be defined. Agree who assigns risk owners and approves treatment decisions.
What should I do after receiving the report?
Confirm the findings with the people responsible for the systems. Agree priorities using business impact, exploitability, existing protection and any uncertainty. Assign an action owner and target date, record who accepts any remaining risk and verify that fixes worked before marking the work complete.
How regularly should a business commission a cyber security assessment?
Agree the review cycle around your risks, changes and any customer, insurer or regulatory requirements. An annual review can be a useful planning baseline, but it is not a universal requirement. Review affected areas after significant changes or incidents, and verify urgent fixes promptly rather than waiting for the next scheduled review.
Contact us or call 0800 396 337 to talk about a cyber security assessment.
