SECURITY ASSESSMENT
The Security Assessment: eight review areas, four deliverables, one ranked roadmap.
A decision tool before it is a technical exercise: what works, where the gaps are and what comes first, so money goes to the fix that matters.
Six situations it is bought for.
- An examination is on the calendar. Finish what you can before the examiner arrives: Examination and Evidence Readiness.
- A supervisory finding landed. On governance or vendors, it needs a corrective action plan with owners and dates.
- A counterparty asked for proof. A government sponsored enterprise, warehouse lender or carrier wants your last independent test.
- A rule changed. The board needs a paper that explains rather than defends.
- Internal audit raised it. Someone who did not build it must answer.
- Something happened. What to report, to whom, by which clock.
Core and Full, published in full.
| Review area | What is examined |
|---|---|
| External exposure | What the internet reaches, and what it reveals |
| Identity and access | Administrative roles, logins, granting and removal, rights that outlived their purpose |
| Cloud and Microsoft 365 | Tenant settings, sharing, administration, logging, trust between services |
| Vulnerability posture | Scan coverage, repeat findings, whether fixes follow |
| Security architecture | Separation, trust boundaries, designs stronger or weaker than they look |
| Policy and governance | Policy against practice, who owns exceptions, how decisions are recorded |
| Vendor and third party risk | Every vendor, AI included: reach, evidence, who accepts it, planning to termination |
| Readiness to respond | Seeing and handling an event, and which clock starts |
Full is the default for an institution with an examination on the calendar, a counterparty requirement or a supervisory finding, because those readers need areas five through eight. Core is the default for an organization taking a first baseline. Unsure? Our first reply says which.
See Cyber Defense for area eight, a Platform Review for one platform, and how COST differs.
Four deliverables, named alike on every page.
Executive Summary
Read in one sitting by people who did not commission the work.
Findings Register
Each finding's evidence, assets, owner and rank, machine readable.
Risk Context
What exploiting each takes and reaches, and which obligation it touches: the evidence behind a rank.
Ranked Roadmap
The order of work and why: configuration, project, or a decision rather than a budget.
The Executive Summary, structure published
- The decision this assessment supported.
- What was reviewed, and what was not.
- The three findings that carry the report.
- What leaving each would cost, as a consequence, not a number.
- The ranked order, and its basis.
- The single thing leadership is asked to decide.
Not a client report extract; we publish none. Length and format follow your scope; you see this before you commission.
How it runs.
- Scoping. The decision, systems, tenants, identity providers and vendors, access, limits, a named contact and a status rhythm, in writing.
- Access. The written list, nothing beyond it. We change, disable or tune nothing; the report says what should change.
- Fieldwork. Review and testing against the scope; any change, live exposure or compromise, you hear at once.
- Quality review. Signed off before you see it.
- Draft walkthrough. Errors fixed with you before the report is final, not in a file that outlives the engagement.
- Closure. Deliverables, access removal list, evidence as it stands.
We need read access to the identity provider and tenant, your system list, policies, vendor file, prior reports and a contact per area. Where a managed provider runs a system, say so at scoping: it changes who grants access and owns the finding.
Access, and getting it back
- We state in writing the access we need and why, at the lowest level that will answer the question.
- You grant it, decide what it is scoped to, and can revoke it at any moment without asking us.
- At closure we list in writing what to remove, item by item, and ask you to confirm it is removed.
The commitment in full is on Trust and Assurance.
The gap is usually the evidence, not the control.
Most institutions have the control but lack dated, owned proof it worked. The assessment builds it in four layers:
- The question an examiner or counterparty asks: who performed your last independent test?
- The artifact that answers it.
- Where it lives, and who owns it.
- The event that refreshes it.
What the assessment is organized against.
| Instrument | Why it matters here | Who it reaches, and who it does not |
|---|---|---|
| FFIEC Information Technology Examination Handbook | The areas follow its public subjects. | Reaches Banks, credit unions, technology service providers. Status Guidance, not a rule; scope scaled to size and complexity. Not It creates no independent legal obligation. |
| Interagency Guidelines Establishing Information Security Standards | Independent testing of key controls. | Reaches Every insured depository institution and its subsidiaries, no size threshold; the program scales to size and complexity and is not excused. Not Credit unions or nonbank lenders. |
| NCUA 12 CFR Part 748, Appendix A | The same work, for credit unions. | Reaches Every federally insured credit union, no asset size exemption. Vendors Appendix A, III.D, with 07-CU-13 and Supervisory Letter 07-01. Not Banks. |
| FTC Safeguards Rule, 16 CFR Part 314 | Its exception decides whether testing is yours. | Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions. Exempt Below 5,000 consumers whose information you maintain (not employees, loans or dollars), 314.6 lifts the written risk assessment (an unwritten one is still owed), testing cadence, written incident response plan and board report. The rest, 314.4(f) and FTC notice included, applies at any size. |
| Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 | Area seven follows its life cycle. | Reaches Every bank the OCC, Federal Reserve and FDIC supervise, no asset size threshold. Status Guidance, not a rule. Not Credit unions; NCUA is not a party. |
| FFIEC Cybersecurity Assessment Tool sunset | This can replace its maturity view. | Status Removed 31 August 2025, voluntary throughout, no successor named. Sunset Statement Points to NIST CSF 2.0, the CISA Performance Goals, the CRI Profile and the CIS Controls, and endorses none. Not An obligation. None arose or ended when it went. |
The FFIEC named no successor; neither do we. Board paper: the board packet article.
SOC 2: area seven reads yours
- Is
- An attestation report on a service organization's own chosen controls, not a certification.
- Reaches
- Required by nobody; demanded only by a counterparty under contract.
- Not
- A discharge of the bank, insurance or 314.4(f) oversight duty by its presence alone.
Whether we hold one: Trust and Assurance.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What this assessment does not claim.
Each report states what was observed and, separately, what is inferred. We do not attest that a finding is closed or represent you to a regulator.
Our advice is not tied to product sales. If Red Stick Solutions ever holds a commercial relationship with a product or platform it discusses with you, that relationship is disclosed to you in writing before it can affect the advice.
Red Stick Solutions will not assess or test a security program it owns as virtual CISO for the same client in the same period. Where a client wants both, the assessment or the test goes to a third party and this firm helps select one.
The policy is on Partners. An AI vendor's approval is the AI Vendor and Third Party Review; both land in one file.
What usually happens next.
It has a finish line; any next step is a separate decision, sometimes none this quarter: the vulnerability program, Advisory and vCISO, or, for a model, the AI Governance Assessment.
| Before | After |
|---|---|
| A view from whoever was asked last | One written baseline, one method |
| Unranked findings | Every rank's basis stated |
| Work a board cannot compare | A ranked roadmap with reasons |
| Evidence searched for when asked | A dated document on file |
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| Retest | One round of verification of remediated findings is included in the fee as standard. Further rounds are quoted, and the proposal states the window. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
The next step is a scope and a number, in writing.
No fee is published: it is fixed to your scope, not an average one. Tell us Core or Full, and what prompted it.
- Fee
- Fixed against this scope, in writing, in the first conversation, before you sign or grant access.
- Duration
- Elapsed time and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.