Assessment, audit or penetration test: what does your business need?

Self-assessment: an initial overview

Self-assessment uses answers about practices and controls to describe the situation. It helps identify missing information, organise improvements and share an aggregate reference. DTS lets you start this process for free.

The result depends on the answers and model scope. It does not mean every system has been technically tested or every vulnerability found.

Audit: review scope and evidence

An audit reviews a defined scope against agreed criteria and documents findings. Agree the systems, method, evidence, deliverables and responsibilities before commissioning it.

DTS verification reviews evidence associated with the product assessment. It must not automatically be equated with any audit, certification or compliance review a customer requests.

Penetration testing: authorised technical checks

A penetration test examines technical weaknesses within authorised systems and conditions. Agree scope with the responsible parties before any testing.

A cybersecurity score is not a penetration test. If you need to test an application or infrastructure, define that objective with a specialist provider.

Compare scope before price

Cost depends on the work included. A price alone cannot describe comparable services. DTS self-assessment can be started for free; contact NALLAM about any additional review needs and available scope.

• Which organisation, services and systems are included?
• Will answers, documents, configurations or technical tests be examined?
• What report and limitations will be provided?
• Is a later review of improvements included?

Choose for the decision you need to make

Start with self-assessment for an initial overview. If a customer needs evidence of controls, confirm what evidence and validation they accept. For a technical weakness, arrange an authorised test of that system.

Combining tools does not make their results interchangeable. Keep verified identity, provisional score and verified assessment distinct.

Frequently asked questions