When someone asks how you protect client data, what do you say?
A client asks during onboarding. An insurance application asks whether multi-factor authentication covers every administrator account. An examiner asks when your security programme was last reviewed.
Maybe your IT company has the answer. Maybe there's a consultant who comes in occasionally. Maybe it's nobody's job. Either way, the client data is yours and so is the obligation to protect it — and "I think we're covered" is not an answer you want to give twice.
The Baseline Assessment gives you a dated, scored answer, in about twenty minutes, in plain language.
What the assessment covers
Thirty controls across six domains — Governance, Awareness, Identity & Access, Data Protection & Backup, Device Security, and Network & Cloud Security — mapped to NIST CSF 2.0 and CIS Controls Implementation Group 1.
You get a maturity score from 1 to 5, findings ordered by severity, and a 30/60/90-day plan sized for a firm without an IT department.
You also get provider question sheets. Every control you couldn't confirm becomes a specific question for whoever can answer it — your IT provider, your platform vendor, your bank, your custodian, or your insurer — with what a good answer looks like written next to it.
Then twelve months of advisory: a monthly one-page note for your staff, a quarterly check on the findings you're still working through, and a full reassessment at twelve months.
Here is a real finding often encountered
Most firms answer "mostly" to this question and mean it.
The two accounts without coverage are the two an attacker would want most. IAM-02 is a critical control, so a gap here caps the firm's overall maturity until it's closed — regardless of how well everything else scores.
Notice what's underneath: the question to send, and what a good answer looks like. That's the difference between knowing you have a gap and being able to do something about it.
Is multi-factor authentication required everywhere — for everyone, not just some people?
The firm answered Mostly.
The two accounts without it are the two an attacker would want most. IAM-02 is a critical control, so this caps the firm's overall maturity until it's closed.
Send to your IT provider
Which accounts are currently exempt from MFA, and why? A good answer names them. Not “everyone’s covered.”
Here's how the score is calculated
No judgement, no model, no adjustment. Six answers, six point values, one total.
DAT-04 is a critical control. Answered Not sure, it caps the firm’s overall maturity at level 4 until someone confirms it either way — regardless of how well everything else scores.
This is one of six domains. Your overall score is calculated across all thirty controls out of a possible 120 — not by averaging the domain figures, since the domains hold different numbers of controls. The report shows the working for every one.
Being straight about what this is
Everything in your report comes from what you tell us. We don't independently verify it, and we say so twice in the report itself — because you'll be showing this to people who'll ask.
It's not an audit or a certification, and nobody can honestly tell you how an examiner or insurer will respond. What it gives you is a dated, structured answer to a question you currently can't answer at all.
And we don't sell the fixes. Your report tells you what kind of provider each gap needs — IT provider, platform vendor, bank, custodian, or insurer. — and the exact question to put to them. If we found the problems and then sold you the solution, you'd be right to wonder.
Founding assessment — first ten firms
$1,495 for your first year — the assessment, your report, and twelve months of advisory.
It renews annually at the same $1,495, and founding pricing doesn't expire. Stay a client and that's your rate. Each year includes a full reassessment showing exactly what moved, so year two isn't a repeat purchase — it's the comparison that makes the first one worth having.
Cancel any time before renewal. If the report doesn't give you a clearer picture of where your firm stands, we'll refund it within 30 days.
Ten firms only. When they're taken, the assessment moves to standard pricing of $2,400 a year.