Risk Assessment
A structured look at your people, data, systems, and vendors. You get a clear picture of your biggest risks and a plan ranked by impact and cost.
Book a free intro callA good fit if you:
Every recommendation ranked by impact, effort, and cost, so you know what to do first.
Changes you can make this month, often at little or no cost.
A simple, living record of your risks that you can keep up to date.
Where your donor, client, and staff data lives, and who can reach it.
A two-page, plain-language brief for your board and funders.
We walk through the findings together and answer your team’s questions.
Fixed price from $3,500, with 20% off for qualifying nonprofits. See pricing →
About three to four weeks, and roughly four to six hours of your team’s time in total.
Week 1
We agree on scope, and I send a short list of documents and access I’ll need.
Weeks 1–2
Conversations with key staff and your IT provider, plus a light review of settings like MFA, backups, and email.
Week 3
I rate likelihood and impact using NIST methods, scaled to an organization your size.
Week 4
You get the full report and plan, and we review it together.
No. A risk assessment looks broadly at people, processes, and technology. A penetration test simulates an attack on specific systems. If you need one, I can help you scope it and choose a trustworthy tester.
NIST SP 800-30 for rating risk and NIST CSF 2.0 to organize findings, scaled to fit a small organization.
The plan is yours. You can work through it on your own, with your IT provider, or with ongoing help from me. If you start a vCISO plan within 60 days, half the assessment fee is credited toward it.
Related services
A free 30-minute call to talk through your situation and scope the assessment.
Book a free intro call