Cybersecurity Assessments: Types, Scope and When to Use Each

Cybersecurity assessments are structured reviews that measure how well your organisation is protected, against a risk, a standard or an attacker's methods. The main types are risk assessments, gap analyses, vulnerability scans, penetration tests, security audits, compliance assessments and third-party reviews. Each answers a different question, so the right choice depends on what you need to know.

The terms are often used loosely, and providers sometimes sell a vulnerability scan as a penetration test or a questionnaire as an audit. Knowing the differences helps you buy the right service and read the result properly.

This guide sets out each type, when to use it, how scope works, what a good report contains and how to prepare.

The main types of cybersecurity assessments

Think of the types as different tools, each suited to a different job.

Risk assessment

Identifies what you need to protect, what could go wrong, how likely it is and what the impact would be. The NCSC's 10 Steps to Cyber Security begins with risk management, noting that understanding what you are trying to protect against is essential. A risk assessment sets the priorities for everything else.

Gap analysis

Compares your current controls with a chosen standard, such as Cyber Essentials or ISO 27001, and lists what is missing. It is a planning tool, normally done before you commit to certification.

Vulnerability scan

An automated check of systems for known weaknesses such as missing patches or insecure settings. It is quick, repeatable and good for routine hygiene, but it lists issues rather than testing whether an attacker could chain them together.

Penetration test

The NCSC describes a penetration test as a method for gaining assurance in the security of an IT system by attempting to breach some or all of its security, using the tools and techniques an adversary might use. Skilled testers try to exploit weaknesses on a defined target.

Security audit

An independent review of policies, configuration and evidence against a defined scope or framework, usually combining interviews, document review and technical checks.

Compliance assessment

Checks whether you meet a specific legal, contractual or sector requirement, such as data protection rules or a customer's security schedule.

Third-party or supplier assessment

Reviews the security of vendors and partners that hold your data or connect to your systems, often using questionnaires and evidence requests.

Comparison table: which assessment answers which question

Use this as a quick guide when comparing quotes.

When to use each type of assessment

For most small and mid-sized organisations, a sensible sequence looks like this:

1. Risk assessment to understand your critical systems and data.
2. Gap analysis against Cyber Essentials or a similar baseline.
3. Fix the basics found, such as MFA, patching and backups.
4. Vulnerability scanning on a regular schedule.
5. Penetration testing of internet-facing systems and key applications, once the basics are in place.
6. Audit or certification for independent assurance.

The NCSC's penetration testing guidance is explicit that a test is not a primary way to find vulnerabilities and should support your own vulnerability assessment and management processes. It also notes a test can only show that systems were free of known issues on the day, and tests are often a year or more apart. Buying one before your basic hygiene is in place tends to produce a long list of issues you could have found yourself.

Scans, in contrast, are cheap to repeat, which makes them the right tool for catching new problems between tests. Pair them with a patching routine so what they find actually gets fixed.

Assessments against Cyber Essentials and ISO 27001

Gap analyses are most often run against a recognised framework. Cyber Essentials covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC says Cyber Essentials combines a self-assessment with an independent audit, while Cyber Essentials Plus assesses the same controls and adds independent technical testing to confirm they work in practice.

ISO 27001 is a broader international standard for managing information security, so a gap analysis against it looks at governance, risk management and policy as well as technical controls. It suits organisations that need to show a management system, often because customers ask for it.

If you are considering the first step, our Cyber Essentials requirements checklist shows what assessors look for, and the Cyber Essentials cost guide explains budgeting.

Typical scope: what to define before work starts

Poor scoping is the most common reason assessments disappoint. The NCSC's guidance says scoping should involve risk owners, technical staff who know the system and a representative of the testing team, and should produce a plan covering technical boundaries, test types, timeframe, effort, scenarios, compliance and reporting requirements, and any special conditions such as out-of-hours testing.

• Assets: which networks, applications, cloud tenants, devices and sites are in or out.
• Depth: external only, internal, authenticated, or social engineering.
• Timing: when testing happens and what to do if something breaks.
• Rules of engagement: what testers may and may not do, and who they call.
• Reporting: severity ratings, audiences and any compliance format needed.
• Authorisation: written permission, including from third-party hosts where relevant.

What a good assessment report contains

The report is the product. A good one is usable by both technical staff and directors.

• An executive summary in plain English with an overall conclusion.
• The scope, method and dates, including anything excluded.
• Findings ranked by severity and business impact, not just technical score.
• Evidence for each finding, such as screenshots or configuration extracts.
• Specific remediation steps, with a suggested order and owner.
• Positive findings, so you know what is working.
• Retest or follow-up arrangements to confirm fixes.

Be cautious of reports that are a raw scanner export. The value comes from the analysis, and the ICO's data security guidance expects organisations to document the results of testing and act on them.

How to prepare for a cybersecurity assessment

Preparation shortens the project and improves the result.

• Name an internal owner and a deputy.
• Gather asset lists, network diagrams, policies and previous reports.
• Share your existing vulnerability findings, which lets testers check their accuracy.
• Tell staff and any third-party hosts that testing is planned.
• Back up critical systems before technical testing starts.
• Agree how you will track and close the findings afterwards.

For technical testing, our guide on how to choose a penetration testing company covers supplier selection in more detail.

Supplier assessments and independent audits

Your exposure includes the suppliers who hold your data. A supplier assessment asks for evidence rather than assurances: certifications, penetration test summaries, incident history and how they manage subcontractors. Read the lessons in our piece on supply chain breaches to see why this matters.

For your own organisation, an independent cyber security audit provides an outside view against a defined scope and framework. NetMonkeys' cyber security audit services combine technical checks with control and policy review, and sit alongside our wider managed IT support, so findings can be fixed as well as reported.

Choosing the right cybersecurity assessments

The right cybersecurity assessments depend on the question you need answered: a risk assessment to set priorities, a gap analysis to plan for a standard, scans for routine hygiene, a penetration test to challenge your defences, and an audit for independent assurance. Define scope carefully, insist on a usable report, and treat every assessment as the start of a fix list, not the end of a project.

To discuss which assessment fits your organisation, contact NetMonkeys.

Frequently Asked Questions (FAQs)