Cybersecurity Assessment
Identify vulnerabilities, control gaps, and organizational exposure.
Learn moreCybersecurity. GRC. Risk. Resilience.
See the Risk. Govern the Risk. Strengthen the Business.
Cybersecurity and GRC for organizations that cannot afford to be unprepared.
SenasoftConsult helps public institutions, growing businesses, and professionals bring cybersecurity, governance, risk, compliance, and resilience together so they can make better decisions, demonstrate control, and operate with confidence.
Who are you looking for support for?
Choose one to see where most engagements like yours begin.
- GRC Consulting
- Audit & Risk Assessment
- Advisory Consultation
- Training & Workshops
- Speaking Engagements
- Multi-sector
- Public | Private | Individuals
- Global standards
- NIST | ISO | CISA
- Book online
- 30-minute consultations
GRC & Compliance
Build practical governance programs aligned with NIST, ISO/IEC 27001, regulatory requirements, and industry expectations.
Learn moreCyber Resilience
Prepare your organization to prevent, respond to, recover from, and adapt to disruption.
Learn moreTrusted guidance.
Global standards.
- NISTCSF 2.0
- ISO/IEC27001
- NISTSP 800-53
- NISTSP 800-171
- CISAPriorities
- IndustryBest practices
Choose the support your organization needs.
Five ways to work together, from a single focused session to a full governance program. Every engagement is scoped to your environment, obligations, and budget.
-
Cybersecurity and GRC consulting
Recommended for youAlign governance, risk, and security operations with your business priorities and regulatory obligations.
- Governance structure, roles, and policy framework design
- Risk register, risk appetite, and treatment planning
- Control mapping to NIST CSF 2.0, ISO/IEC 27001, and sector regulation
- AI governance aligned to ISO/IEC 42001 and the NIST AI RMF
-
Audit and risk assessment packages
Recommended for youFind out where you stand against a recognized standard, with findings ranked by the risk they carry.
- Scoped gap assessment against the framework you select
- Control testing and evidence review
- Risk-rated findings written for technical and executive readers
- A prioritized remediation roadmap with owners and timelines
-
Advisory consultation
Recommended for youGet an experienced second opinion on a specific decision before you commit time or budget to it.
- Focused sessions on incident readiness, vendor risk, regulatory obligations, or board reporting
- Review of existing policies, plans, or proposals
- A written summary of recommendations after each session
-
Training and workshops
Recommended for youPractical sessions that build the security and governance skills your people use every day.
- Security awareness for staff and leadership
- GRC and risk management fundamentals
- Incident response tabletop exercises
- AI governance and responsible AI management
-
Speaking engagements
Recommended for youTalks and panel contributions for conferences, public-sector forums, and professional associations.
- Cyber governance and board-level accountability
- Critical-infrastructure resilience
- AI risk and emerging technology governance
- The evolving cybersecurity regulatory landscape
Why SenasoftConsult
Security advice built to stand up to scrutiny.
Leaders need findings they can defend to a board, an auditor, or a regulator, and recommendations their teams can carry out. Every engagement is designed around those two tests.
Evidence-led
Every finding states what was reviewed or tested and why it matters, so conclusions hold up when someone asks how you know.
Standards-aligned
Work is mapped to the frameworks you answer to, such as NIST CSF 2.0 and ISO/IEC 27001, so effort counts toward compliance as well as security.
Practical
Recommendations are ranked by risk and sized to your budget and team, and written so the people doing the work can act on them.
Business-oriented
Cyber risk is explained in the terms leadership uses: impact, cost, ownership, and the decision needed, rather than tool output.
A defined process, so you know what you are paying for.
Every engagement follows the same four stages: Assess, Govern, Protect, Prepare. Scope and deliverables are agreed in writing before work begins.
Assess
Confirm your objectives and scope, then review policies, controls, and evidence against the standards and obligations that apply to your sector.
Govern
Rank findings by risk and turn them into decisions: owners, policies, risk appetite, and a roadmap leadership can track.
Protect
Support implementation of the priority controls, train the people involved, and verify that the controls work as intended.
Prepare
Exercise response and recovery plans, and track progress against the measures you set, so the organization can absorb and adapt to disruption.
- HIPAA
- NIST CSF 2.0
- NIST SP 800-53
- ISO/IEC 27001
- ISO/IEC 42001
- COSO
- COBIT 2019
- NIST AI RMF
- CIS Controls
- CISA CPGs
About SenasoftConsult
SenasoftConsult is a cybersecurity and governance practice serving governments, SMEs, and individuals worldwide.
The practice is led by a cybersecurity and digital forensics professional whose work spans cyber governance, incident response, threat intelligence, enterprise risk, and critical-infrastructure resilience, alongside research and policy development.
That range matters in practice: governance advice is grounded in how incidents actually unfold, and technical findings are translated into decisions leaders can act on.
Areas of focus
- Cyber governance and risk management
- Incident response and digital forensics
- Threat intelligence
- Critical-infrastructure resilience
- AI and emerging technology governance
Book a consultation.
Tell us a little about your organization and what you need, then choose a time that suits you. You will review your booking before it is sent, and a consultant will reply within 24 hours to confirm.
What happens next
Prefer email? Write to info@senasoftconsult.com.
Confirm your booking
Please check the details below. Nothing has been sent yet.
@SenasoftConsult, your needs are our service. A consultant will get back to you within 24 hours. Thank you!!
Research
Research and policy work on how organizations govern cyber and AI risk, and how essential services stay resilient when things go wrong.
Focus areas
The questions that shape this practice's research, and the advice it gives clients.
Cyber governance and board accountability
How leadership teams set risk appetite, assign ownership, and measure whether security investment is reducing risk.
Critical-infrastructure resilience
How operators of essential services prepare for, withstand, and recover from disruption, and how public policy can support them.
AI governance and assurance
How organizations put management systems and controls around AI so its use can be explained, audited, and trusted.
Incident response and reporting obligations
How overlapping reporting deadlines across regulators change the way incident response has to be planned and rehearsed.
Core regulatory frameworks
The laws, standards, and frameworks this practice works with. Engagements map your controls and evidence to the ones that apply to you.
- Official source for HIPAA Privacy, Security, and Breach Notification Rules (opens in a new tab)
HIPAA Privacy, Security, and Breach Notification Rules
Federal requirements for protecting health information held by covered entities and their business associates, including administrative, physical, and technical safeguards.
GLBA Safeguards Rule (16 CFR Part 314)
Requires non-bank financial institutions to run a written information security program with a designated qualified individual, risk assessment, and board reporting.
SEC cybersecurity disclosure rules (2023)
Require public companies to disclose material cybersecurity incidents and to describe cyber risk management, strategy, and governance in annual reports.
- Official source for CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) (opens in a new tab)
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)
Once the final rule takes effect, covered critical-infrastructure entities must report covered cyber incidents within 72 hours and ransom payments within 24 hours.
FISMA
Requires federal agencies and their contractors to implement risk-based information security programs, built on NIST standards and guidelines.
- Official source for CMMC (32 CFR Part 170) (opens in a new tab)
CMMC (32 CFR Part 170)
Verifies that defense contractors protect Federal Contract Information and Controlled Unclassified Information at the required maturity level.
- Official source for GDPR (opens in a new tab)
GDPR
Sets requirements for processing personal data of people in the EU, including security of processing and 72-hour breach notification to authorities.
- Official source for NIS2 Directive (opens in a new tab)
NIS2 Directive
Cybersecurity risk-management and incident-reporting obligations for essential and important entities, with explicit accountability for management bodies.
- Official source for NIST Cybersecurity Framework (CSF) 2.0 (opens in a new tab)
NIST Cybersecurity Framework (CSF) 2.0
Outcome-based framework organized around six functions (Govern, Identify, Protect, Detect, Respond, Recover) for managing cybersecurity risk.
- Official source for NIST SP 800-53 Rev. 5 (opens in a new tab)
NIST SP 800-53 Rev. 5
Comprehensive catalog of security and privacy controls, used as the baseline for federal systems and widely adopted beyond government.
- Official source for NIST SP 800-37 Rev. 2 (Risk Management Framework) (opens in a new tab)
NIST SP 800-37 Rev. 2 (Risk Management Framework)
Seven-step process for categorizing systems, selecting and assessing controls, authorizing systems, and monitoring them continuously.
- Official source for NIST SP 800-61 Rev. 3 (opens in a new tab)
NIST SP 800-61 Rev. 3
Incident response recommendations aligned to CSF 2.0, treating response as part of overall cybersecurity risk management.
- Official source for ISO/IEC 27001:2022 (opens in a new tab)
ISO/IEC 27001:2022
Requirements for establishing, operating, and continually improving an information security management system (ISMS).
- Official source for ISO/IEC 27002:2022 (opens in a new tab)
ISO/IEC 27002:2022
Implementation guidance for the information security controls referenced in ISO/IEC 27001.
- Official source for CIS Critical Security Controls v8.1 (opens in a new tab)
CIS Critical Security Controls v8.1
Prioritized set of safeguards, grouped into implementation groups, that give smaller organizations a practical starting point.
- Official source for PCI DSS v4.0.1 (opens in a new tab)
PCI DSS v4.0.1
Security requirements for any organization that stores, processes, or transmits payment card data.
- Official source for COSO Internal Control, Integrated Framework (2013) (opens in a new tab)
COSO Internal Control, Integrated Framework (2013)
The reference framework for designing and evaluating internal control, including the controls that underpin financial reporting.
- Official source for COSO Enterprise Risk Management (2017) (opens in a new tab)
COSO Enterprise Risk Management (2017)
Connects risk management with strategy and performance, giving boards a common language for cyber risk alongside other enterprise risks.
- Official source for COBIT 2019 (opens in a new tab)
COBIT 2019
Governance and management framework for enterprise information and technology, linking IT objectives to business goals.
- Official source for ISO 31000:2018 (opens in a new tab)
ISO 31000:2018
Principles and a process for managing risk of any type, used to align cyber risk with enterprise risk practice.
SOC 2 (Trust Services Criteria)
Independent auditor reports on a service organization's controls for security, availability, processing integrity, confidentiality, and privacy.
- Official source for ISO/IEC 42001:2023 (opens in a new tab)
ISO/IEC 42001:2023
Requirements for an AI management system (AIMS) that governs how an organization develops, provides, or uses AI responsibly.
- Official source for NIST AI Risk Management Framework 1.0 (opens in a new tab)
NIST AI Risk Management Framework 1.0
Voluntary framework for managing AI risks across four functions: Govern, Map, Measure, and Manage.
- Official source for EU Artificial Intelligence Act (opens in a new tab)
EU Artificial Intelligence Act
Risk-based rules for AI systems placed on or used in the EU market, with obligations phased in over several years.
- Official source for ISO 22301:2019 (opens in a new tab)
ISO 22301:2019
Requirements for a business continuity management system, so critical activities continue or recover within defined timeframes.
- Official source for CISA Cross-Sector Cybersecurity Performance Goals (opens in a new tab)
CISA Cross-Sector Cybersecurity Performance Goals
Baseline, voluntary cybersecurity practices that critical-infrastructure owners and operators can adopt to reduce the most common risks.
NERC CIP Reliability Standards
Mandatory cybersecurity requirements for entities that own or operate the bulk electric system in North America.
Listed for reference. SenasoftConsult is independent and not affiliated with, or endorsed by, the organizations that publish these frameworks.
News
The regulatory changes and threat trends shaping our clients' obligations, with what each one means in practice.
Updated 1 October 2026. Timelines change often; confirm with the issuing authority before relying on a date.
Key dates ahead
Deadlines our clients are planning around, in date order.
- 10 Nov 2026CMMC Phase 2: Level 2 third-party certification in applicable DoD solicitations
- 2 Dec 2026EU AI Act: marking of AI-generated content for systems already on the market
- 11 Dec 2026Cybersecurity Information Sharing Act of 2015 expires unless extended
- July 2027HIPAA Security Rule final action (target, not binding)
- 2 Dec 2027EU AI Act: high-risk obligations for stand-alone (Annex III) systems
- 11 Dec 2027EU Cyber Resilience Act: full application
- To be setCIRCIA reporting begins on the final rule's effective date
Regulatory watch
New obligations and the status of pending rules in the U.S. and EU.
EU Cyber Resilience Act: vulnerability and incident reporting is now mandatory
Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe security incidents through ENISA's new Single Reporting Platform. An early warning is due within 24 hours, a full notification within 72 hours, and a final report within 14 days for vulnerabilities or one month for incidents. This applies to products already on the market, not only new ones. The rest of the Act applies from 11 December 2027.
What it means for you: Manufacturers and software vendors selling into the EU need a working process to detect, triage, and report exploitation within 24 hours. If you rely on such vendors, ask how they are meeting this duty.
Sources: ENISA, Hogan Lovells Cadwalader
CMMC Phase 2: third-party Level 2 certification becomes a condition of award
From 10 November 2026, applicable Department of Defense solicitations will require contractors that handle Controlled Unclassified Information to hold a CMMC Level 2 certification from an accredited third-party assessor, not a self-assessment. Assessor capacity is limited, so lead times are significant.
What it means for you: Defense contractors and their subcontractors should confirm which contracts are in scope, close gaps against NIST SP 800-171, and book an assessment now rather than after a solicitation arrives.
Sources: Chainguard, DoD CIO: CMMC
CIRCIA: the September target passes without a final rule
CISA had targeted September 2026 for the final rule under the Cyber Incident Reporting for Critical Infrastructure Act. As of 1 October 2026, CISA still states that organizations do not have to report until a final rule is published and takes effect. Once it does, covered entities in 16 critical-infrastructure sectors must report covered incidents within 72 hours and ransom payments within 24 hours.
What it means for you: The timing keeps moving, but the 72-hour and 24-hour clocks are fixed in the statute. Use the extra time to confirm whether you are covered and to build the reporting decision into your incident response plan.
Sources: CISA, Bright Defense
Cyber threat information-sharing law extended only to 11 December 2026
The Cybersecurity Information Sharing Act of 2015, which gives companies legal protections when they share cyber threat indicators with the government and each other, was extended to 11 December 2026 by the stopgap funding law signed on 2 September. A long-term reauthorization has not passed.
What it means for you: If the law lapses, the liability and antitrust protections for sharing threat information could lapse with it. Legal and security teams should agree now on how they will share threat information if that happens.
Sources: Defense One, Federal News Network
EU AI Act: high-risk deadlines deferred, transparency duties now apply
The EU's Digital Omnibus on AI entered into force on 27 July 2026. It defers obligations for stand-alone high-risk AI systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. The Article 50 transparency obligations were not deferred, and machine-readable marking of AI-generated content applies to systems already on the market from 2 December 2026.
What it means for you: The extra time is best used to inventory AI systems, classify their risk, and build a management system such as ISO/IEC 42001 that will support compliance when the deadlines arrive.
Sources: DLA Piper, Usercentrics
HIPAA Security Rule overhaul: final action now targeted for July 2027
HHS proposed the largest update to the HIPAA Security Rule in two decades in January 2025, including mandatory encryption of ePHI, multi-factor authentication, and stricter oversight of business associates. The federal regulatory agenda has moved the final rule to a July 2027 target, and it could still change or be withdrawn.
What it means for you: The current Security Rule is still being enforced, and risk analysis remains the most frequently cited deficiency. A current, documented risk analysis is the best preparation for either outcome.
Sources: Clark Hill, The HIPAA Journal
Threat trends
What the latest evidence says about how breaches happen.
Exploited vulnerabilities and third parties now drive breaches
Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the leading way in, at 31% of breaches, while credential abuse fell to 13%. Third parties were involved in 48% of breaches, and ransomware appeared in 48%. Patching slowed: the median time to fully remediate rose to 43 days, and only 26% of vulnerabilities in CISA's Known Exploited Vulnerabilities catalog were fully remediated.
What it means for you: Prioritize patching by known exploitation rather than severity score alone, and review critical vendors continuously rather than once a year. Both are now where most breaches start.
Sources: SecurityWeek, Help Net Security
Cybersecurity Awareness Month 2026: “Don't Make It Easy for Them”
The National Cybersecurity Alliance opened the 23rd Cybersecurity Awareness Month on 1 October with a focus on four everyday habits: strong, unique passwords; multi-factor authentication; keeping devices updated; and caution with suspicious messages.
What it means for you: October is a good moment for a short staff refresher and a check that multi-factor authentication is enforced on email, remote access, and administrator accounts.
Sources: National Cybersecurity Alliance
Earlier news
Previous editions, kept for reference. Some details have since changed; see the current items above for the latest status.
September 2026 edition3 items: HIPAA, CIRCIA, EU AI Act
The CIRCIA item below reflects CISA's September target, which has since passed without a final rule.
HIPAA Security Rule overhaul: final action now targeted for July 2027
HHS proposed the largest update to the HIPAA Security Rule in two decades in January 2025, including mandatory encryption of ePHI, multi-factor authentication, and stricter oversight of business associates. The federal regulatory agenda has since moved the final rule to a July 2027 target, and it could still change or be withdrawn.
What it means for you: The current Security Rule is still being enforced, and risk analysis remains the most frequently cited deficiency. A current, documented risk analysis is the best preparation for either outcome.
Sources: Clark Hill, The HIPAA Journal
CIRCIA final rule targeted for September 2026
CISA missed the October 2025 statutory deadline for the CIRCIA final rule, held stakeholder town halls in June 2026, and now targets September 2026 for publication. Once in effect, covered entities across 16 critical-infrastructure sectors must report covered cyber incidents within 72 hours and ransom payments within 24 hours.
What it means for you: Those reporting clocks are set in the statute. Organizations that may be covered should confirm scope now and build the reporting decision into their incident response plans. Check cisa.gov/circia for publication status.
Sources: Hunton Andrews Kurth, Federal News Network
EU AI Act: high-risk deadlines deferred, transparency duties now apply
The EU's Digital Omnibus on AI entered into force on 27 July 2026. It defers obligations for stand-alone high-risk AI systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. The Article 50 transparency obligations were not deferred.
What it means for you: The extra time is best used to inventory AI systems, classify their risk, and build a management system such as ISO/IEC 42001 that will support compliance when the deadlines arrive.
Sources: DLA Piper, Usercentrics
Firm announcements
SenasoftConsult launches a new website and visual identity
The new site brings together the firm's services, its approach, its research focus, and its leadership team, alongside a refreshed logo and brand system built for clarity across print and screen.
Our team
SenasoftConsult is led by three partners who share responsibility for the quality of every engagement, from first scoping call to final report.
H.E Senanu
Managing Consultant
Senanu leads the firm's strategy, client relationships, and the quality of its advisory work. A cybersecurity and digital forensics professional, he works across cyber governance, incident response, threat intelligence, enterprise risk, and critical-infrastructure resilience, alongside research and policy development.
That combination shapes how the firm works: governance advice grounded in how incidents actually unfold, and technical findings translated into decisions leaders can act on.
Areas of expertise
Partners
M.K.
Managing Partner, Innovation
Leads the firm's work on emerging technology, including how clients adopt AI and new tools with the right controls in place, and how the firm's own methods and service offerings evolve.
Responsibilities
- Emerging technology and AI adoption advisory
- Development of new services and delivery methods
- Research partnerships and thought leadership
E.R. Obama
Partner, Global Relations and Equity
Leads the firm's international relationships and partnerships, and makes sure its services reach organizations of every size and region, including governments and SMEs with limited security resources.
Responsibilities
- International partnerships and client relationships
- Public-sector and multilateral engagement
- Equitable access to cybersecurity capability
Services / Cyber Risk Assessment
Cyber Risk Assessment
Find out where you stand against a recognized standard, with findings ranked by the risk they carry and a roadmap your team can act on.
The problem
You can't manage risk you haven't measured.
Most organizations know they carry cyber risk. Few can say how much, where it sits, or what to fix first.
Without that baseline, security spending follows the loudest concern, audit findings arrive as surprises, and leaders struggle to show regulators, insurers, or customers that risk is under control.
Outcomes
What you have at the end.
A clear baseline
Where you stand against the standard you chose, control by control.
Risk-ranked findings
Gaps rated by the risk they carry, so effort goes where it matters most.
A roadmap with owners
Prioritized remediation with owners and timelines your team can track.
Reporting for two audiences
Findings written for both technical teams and executive readers.
Method
Assess, Govern, Protect, Prepare.
The assessment follows the same four stages as every SenasoftConsult engagement. Scope and deliverables are agreed in writing before work begins.
Assess
Agree the standard, systems, and people in scope, then review policies, controls, and evidence and interview the people responsible.
Govern
Rate each gap by likelihood and impact, and assign an owner so every finding has someone accountable for it.
Protect
Turn the findings into a prioritized remediation roadmap, sequenced to reduce the most risk for the budget available.
Prepare
Set the measures that show progress and identify where response and recovery readiness need attention next.
Deliverables
What you receive.
- Scoped gap assessment against the framework you select
- Control testing and evidence review
- Risk-rated findings written for technical and executive readers
- A prioritized remediation roadmap with owners and timelines
Standards alignment
Measured against the framework you answer to.
Choose the standard your sector, regulator, or customers expect. Findings map directly to its controls, so remediation also builds your compliance evidence.
- NIST CSF 2.0
- ISO/IEC 27001
- NIST SP 800-53
- CIS Controls
- CISA CPGs
- HIPAA
Engagement model
How we work together.
- Scope
- Fixed and agreed in writing before work begins: the standard, the systems and teams in scope, and the deliverables.
- Price
- Quoted after the first consultation, once the scope is clear.
- Timeline
- Set by the scope and confirmed in the written agreement.
- Working sessions
- Interviews and reviews by video or phone, scheduled around your team.
Proof
Why you can rely on the results.
The method is published, the findings trace back to evidence, and every rating can be explained to an auditor or a board.
The assessment is led by a cybersecurity and digital forensics professional whose work spans cyber governance, incident response, threat intelligence, and critical-infrastructure resilience.
FAQ
Common questions.
Which standard should we be assessed against?
Use the one your regulator, sector, or customers require. If none is required, NIST CSF 2.0 is a widely recognized starting point. The first consultation is where the right fit is agreed.
Do you need access to our systems?
The assessment reviews documents and evidence and interviews the people responsible. Any technical testing is agreed in writing as part of the scope before it starts.
Will this get us certified?
No. Certification is issued by accredited certification bodies. The assessment shows where you stand against the standard and what to fix before a certification or regulatory audit.
What does it cost?
The price depends on the standard, the size of the scope, and the evidence available. You receive a written quote after the first consultation.
How do we get started?
Book a 30-minute consultation. A consultant confirms the meeting within 24 hours, and the call is used to understand your objectives and agree whether an assessment is the right next step.
Start with a 30-minute consultation.
Tell us what you need to know about your cyber risk, and agree the right scope together.