Evaluate the controls, processes, and technology supporting your cybersecurity program, with testing designed to help you demonstrate readiness to boards, regulators, and auditors.
As AI becomes embedded in business processes and third-party tools, organizations face new cybersecurity risks alongside heightened oversight expectations.
Johnson Lambert’s cybersecurity assessments are tailored to the industries we serve and aligned with relevant regulatory requirements and recognized frameworks.
Depending on your organization’s needs and risk profile, our work may draw on the NIST Cybersecurity Framework, the NYDFS Cybersecurity Regulation, CIS Controls, COBIT, AICPA Trust Services Criteria, COSO, and ISO 27001.
As members of the Center for Internet Security, we use CIS benchmarks alongside proprietary tools to evaluate cybersecurity controls and document findings in a tailored summary report.
Our cybersecurity assessments follow a four-phase approach, from initial planning through testing, findings, and recommended next steps.
We develop an understanding of your IT environment, data flows, key systems, and stakeholders, then define the scope and risk criteria for the assessment.
We meet with key personnel, review relevant policies and documentation, and walk through critical cybersecurity processes to understand how controls are designed and carried out.
We test key controls, identify gaps, and evaluate how effectively your cybersecurity program is operating. Findings and recommendations are discussed with management as the assessment progresses.
We document the results, outline recommended next steps, and provide a roadmap to help strengthen cybersecurity processes and support future board, regulatory, or audit review.
A cybersecurity assessment helps leadership understand whether key controls are designed and operating as intended, where gaps may exist, and what steps can strengthen the organization’s overall cyber program.
Cybersecurity assessments can be customized based on your organization’s objectives, reporting needs, and the level of independent verification required.
A facilitated review of your cybersecurity governance, key processes, and layers of security.
Review of policies, documentation, and supporting evidence to determine whether key cybersecurity controls are appropriately designed and implemented.
Testing performed over a defined period to determine whether key controls are operating as intended.
An examination performed in accordance with the AICPA’s cybersecurity risk management reporting framework, resulting in an independent report on the organization’s cybersecurity risk management program.
ARTICLE
Learn how to test whether key cyber controls are working, uncover gaps early, and prepare for regulatory or external review.
READ MORE →
WEBINAR
Join us for a one-hour session on annual requirements, third-party risk in the age of AI, and what real readiness looks like, featuring a peer conversation with an executive who manages this risk firsthand.
READ MORE →
ARTICLE
Explore how AI has become both a cybersecurity risk and a valuable defense tool, and what insurers should consider as they strengthen oversight, controls, and fraud prevention.
READ MORE →
Our cybersecurity work is informed by decades of experience serving insurance organizations and nonprofits, with teams that understand the regulatory, operational, and governance issues affecting these sectors.
years serving insurance organizations, with specialized teams to navigate the industry's unique regulatory expectations, reporting requirements, and operational landscape.
insurance clients nationwide, spanning property and casualty, life, health, title, reinsurance, captives, and MGAs.
largest auditor of P&C insurers nationwide. Deep familiarity with governance and oversight expectations, and active involvement in the AICPA, NAIC, and IASA to keep our teams close to the issues affecting insurance leaders.
years of niche-focused experience, with nonprofit teams committed to supporting foundations and associations of various sizes and complexities.
nonprofit clients nationwide, including CDFIs, PACs, member organizations, professional societies, religious, arts & cultural, and social service organizations.
in organizations such as AICPA, NAIC, IASA, ASAE, and Association Forum keeps our team close to the issues affecting insurance and nonprofit leaders.
Our team brings experience across IT assurance, SOC, third-party risk, and AI governance.
AI and other emerging technologies are creating new exposures that can be easy to miss until they become findings or incidents. Johnson Lambert can help uncover weak points early and give your organization a path for addressing them.
Contact Our Team
