An assessment is a structured evaluation that tells you where you stand and what to improve. Unlike an audit, it does not end in a pass or fail, and it is usually more collaborative. In cybersecurity and compliance, there are several types and methods of assessment, each answering a different question.
This guide explains the most common types, the methods assessors use and how to choose the right one.
Assessment vs audit in one line
An audit checks conformity against fixed criteria for others to rely on. An assessment, on the other hand, helps you understand and improve. For the full comparison, read audit vs assessment.
Types of assessment
| Type | Question it answers | Typical output |
|---|---|---|
| Gap assessment | How far are we from a standard, such as ISO 27001? | List of gaps and a roadmap |
| Risk assessment | Which risks matter most? | Risk register with ratings |
| Vulnerability assessment | Which known weaknesses exist in our systems? | Prioritised vulnerability list |
| Penetration test | Can an attacker actually break in, and how far can they go? | Proven attack paths and fixes |
| Maturity assessment | How developed are our capabilities? | Maturity scores, for example 1 to 5 |
| Third-party (vendor) assessment | Is this supplier secure enough? | Risk rating and conditions |
| Readiness assessment | Are we ready for certification? | Go/no-go view and remaining actions |
| Privacy impact assessment | What privacy risks does this project create? | Risks and safeguards for personal data |
Methods assessors use
Document review
Reviewing policies, procedures, diagrams and previous reports shows how things are supposed to work.
Interviews and workshops
Talking to owners and staff reveals how processes really work, including workarounds.
Questionnaires
Standard questionnaires, such as vendor security questionnaires, gather information at scale. However, answers need verification, because people tend to be optimistic.
Observation
Watching a process, such as a user onboarding or a backup restore, confirms whether it happens as described.
Technical testing
- Configuration reviews compare settings with hardening baselines.
- Vulnerability scanning finds known weaknesses automatically.
- Penetration testing uses manual techniques to prove real impact.
- Phishing simulations test user awareness.
Sampling
Instead of checking everything, assessors test a representative sample, such as 20 user accounts, and draw conclusions.
Scoring approaches
- Qualitative: high, medium and low ratings; simple and fast.
- Quantitative: estimated financial loss or probability; useful for investment decisions.
- Maturity models: levels such as initial, managed, defined and optimised, often based on frameworks like NIST CSF or CMMI-style scales.
Choosing the right assessment
- Starting an ISO 27001 project? Begin with a gap assessment.
- Need to prioritise security spending? Run a risk assessment.
- Releasing a new application? Combine a vulnerability scan with a penetration test.
- Onboarding a critical supplier? Use a third-party assessment.
- Approaching certification? Do a readiness assessment first.
Our ISO 27001 readiness assessment and VAPT services cover the most common needs.
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
