CIS
Readiness
CIS Controls are not a certification - they are the most practical prioritisation of security work available, ordered so that the first handful stops most of what actually happens. We run readiness against them when you want a defensible security programme without a specific audit driving it.
Who this is for
Readiness earns its cost when something is waiting on the other side of it. These are the situations where it pays for itself.
Companies who need a security programme before they need a certificate
Teams asked by an insurer, investor, or customer to show a structured security baseline
Organisations choosing where to spend a limited security budget first
Anyone preparing for SOC 2 or ISO 27001 later and wanting the technical foundation right now
What the engagement does
Your Lorikeet team runs the assessment, collects and vets the evidence, and keeps control status current. You are not handed a spreadsheet and wished well.
- Establish which Implementation Group fits your size and risk
- Assess the safeguards in scope and record where you stand
- Prioritise the gap list by what actually reduces risk rather than by control number
- Map the work to whichever certification you expect to pursue next, so nothing is done twice
- Build the evidence set
- Produce a roadmap your team and your board can both follow
What you walk away with
A clear position against a recognised baseline, a prioritised roadmap, and a technical foundation that makes the next framework cheaper. Because CIS maps cleanly onto SOC 2, ISO 27001 and PCI DSS, this work carries forward.
How it runs
Four phases. You always know which one you are in and what is outstanding.
Scoping call
We establish what is in scope, which assessment path applies, and what you already have. It costs nothing, and it ends with a straight answer about whether readiness is the right spend right now.
Assessment
We walk the control set and record where you actually stand, control by control. The gap list lands early so your team can start on the long items while the rest of the assessment continues.
Remediate and evidence
We work the gap list down with your team and collect what each control needs, filed against the control it belongs to with an owner and an expiry date rather than dumped in a folder.
Hand off to your assessor
You go in with a package that maps requirement to control to evidence, and we stay available through the assessment itself.
What the assessment covers
The control areas we walk for CIS. Each breaks down into individual controls carrying status, owner and evidence in Talon.
CIS Controls carry no certification. Readiness here is about a defensible, prioritised programme - and about doing the groundwork before a framework with an auditor attached.
It runs in Talon, not in a spreadsheet
Every control, its status, its owner and its evidence sit in the portal your team already uses, so the readiness picture you see is the one your Lorikeet team is maintaining rather than a copy that went stale a fortnight ago.
- Control-by-control status, kept current by the people doing the work
- Evidence filed against the control it satisfies, with expiry dates tracked
- The auditor request list, so nothing is chased over email
- A readiness view that shows what an assessor would see
Tools like Vanta monitor controls continuously once they exist and work. Readiness is the part before that: deciding the boundary, designing the controls, and closing the gaps a monitoring tool would otherwise report as permanently red. We work alongside them, and we are a Vanta MSP partner.
Our partnersAsked on almost every CIS call
IG1 is the baseline every organisation should meet. IG2 suits companies with dedicated security staff and regulated data. IG3 is for organisations facing targeted attacks. Picking honestly matters more than picking high.
Often yes, first. CIS tells you what to fix; SOC 2 tells you what to evidence. Companies that do CIS work first tend to have a much shorter SOC 2 gap list.
Yes, and many do. It is not a certificate, but a documented position against CIS with a roadmap answers most security questionnaires better than a policy pack does.
Cleanly. Our control catalogue cross-maps CIS safeguards to SOC 2 criteria, ISO 27001 Annex A and PCI DSS requirements, so evidence collected once counts everywhere it applies.
Rarely run alone
Controls overlap heavily between frameworks, and evidence collected once counts everywhere it applies. A second framework costs a fraction of the first.
CIS readiness, on your timeline
A scoping call costs nothing and ends with a straight answer: what the work involves, what it costs, and whether you need it yet.
