Security Risk Assessment & Gap Analysis
Structured, analytical, decision support
When you need more than a quick health check — you need a structured, analytical view of your risks. Our Security Risk Assessment & Gap Analysis provides detailed, evidence-based insight to support decision-making, certification, and governance.
Who it's for
Think of it like a diagnostic scan — precise measurements, detailed analysis, and a treatment plan. Where the Cyber Health Check provides a broad snapshot, this is a deeper, formal examination that creates an actionable foundation for risk reduction, certification, and governance.
- • Organisations seeking certification or assurance (e.g. ISO 27001, DCC, IASME Cyber Assurance).
- • Businesses needing formal documentation for board governance, insurance, or regulatory submission.
- • Clients progressing from a Cyber Health Check to a more structured and measurable analysis.
What's included
Our approach combines proven methodologies (ISO 27005, NIST, or our in-house Enterprise IT Risk Assessment – EPRA) with practical insight, creating a clear risk register, treatment plan, and board-ready report you can act on immediately.
- • Structured Methodology – based on ISO 27005, NIST, or our internal EPRA framework.
- • Comprehensive Discovery – detailed interviews, asset identification, and control review.
- • Threat & Vulnerability Mapping – contextualised to your organisation and environment.
- • Risk Scoring & Prioritisation – likelihood, impact, and residual risk analysis.
- • Control Effectiveness Review – mapped to recognised standards and frameworks.
- • Gap Analysis – identifies missing controls and improvement opportunities.
How we work
Scoping & Planning
Agree objectives, assets, and methodology.
Interviews & Data Gathering
Capture insights from stakeholders and systems.
Analysis & Scoring
Assess threats, vulnerabilities, and control effectiveness.
Reporting & Read-Out
Deliver a detailed risk register, treatment plan, and board summary.
Follow-Up Support
Optional workshops or guidance for mitigation tracking and review.
What you get
Formal Risk Register
Likelihood, impact, and ownership defined for each risk.
Treatment Plan
Recommended actions, responsible owners, and prioritised timelines.
Compliance Evidence
Mapped to standards such as ISO 27001 Annex A, NIST CSF, or DCC control sets.
Board-Ready Reporting
Clear summaries for leadership and audit purposes.
Next steps on your journey
The outputs of a Security Risk Assessment directly support:
- • ISO 27001 Readiness & Support
- • Defence Cyber Certification (DCC)
- • Business Continuity & Disaster Recovery (BCDR)
- • Policy & Governance Support
It helps you make confident, evidence-backed decisions about what matters most.
Proven results
See how we've helped businesses achieve their cybersecurity goals
Why choose Dalton Cyber
Why choose Dalton Cyber
Dalton Cyber delivers structured, evidence-based Security Risk Assessments to help organisations identify, quantify, and manage cybersecurity risk. Ideal for teams preparing for ISO 27001, IASME Cyber Assurance, or Defence Cyber Certification (DCC), it provides the formal documentation needed for governance, assurance, and insurance purposes.
Experienced team
Trusted by defence and public-sector supply chains.
Framework-aligned
Consistent with NCSC, ISO, IASME, and MoD methodologies.
Plain-English delivery
Clear outputs for leadership and audit readiness.
Action-focused
Prioritised, realistic recommendations — not theoretical models.
Ready to get started?
Book a free consultation to discuss your requirements and timelines. We'll help you scope your assessment, prepare your evidence, and get certified with confidence.