CIRA Basic assesses your organization by utilizing a wide variety of external sources of information.     

 

Using open-source intelligence (OSINT), Nth Generation scours through the information that both hackers and insurance carriers utilize, such as: Google, social media, forums, leaked data dumps, VirusTotal, Censys, Cymon, Shodan and others.

 

Your Organization only needs to provide a domain name.

CIRA BASIC +

 

• CIS Controls Gap Assessment

• External Penetration Test

 

By including the External Penetration Test, validation can be made as to potential vulnerabilities, patch requirements, or other remediation steps that should occur before soliciting insurance coverage.

 

The inclusion of the CIS Controls Gap Assessment provides a top-down best-practice based view of the organization that aligns with a widely adopted Cybersecurity framework.

​

​Your total time investment is minimized to: a) Providing a domain name; b) Having a team session(s) lasting approximately 2-4 hours, and c) Providing in-scope information for the External
Penetration Test.

CIRA BASIC + ADVANCED + 

 

• Internal Penetration Test

 

More and more insurance agencies understand that organizations may have a strong external posture but may have substantial security weaknesses inside of the perimeter boundaries. 

 

By assessing the internal security posture organizations gain a holistic view of the overall information security vulnerabilities and posture of the entity.

 

Your total time investment remains relatively low: the requirements for the Advanced CIRA + providing in-scope internal network details.

CIRA BASIC + ADVANCED +      COMPLETE +

​

• Ransomware Readiness Assessment SM  (RRASM)

​

This CIRA tier also includes:

​

A holistic view of your organization’s information security posture, susceptibility, resilience and auditability should a ransomware incident occur.   

 

Providing everything that “CIRA COMPLETE” offers in conjunction with our Ransomware Readiness Assessment SM (RRA SM), organizations can validate the quality of the implementation of the security technologies or countermeasures they’ve invested in and highlight areas which may need to be improved upon to reduce the risks associated with a ransomware incident. 

 

Your time investment consists of the CIRA COMPLETE requirements + approximately 8-12 hours to conduct the RRASM assessment.

 

Approximately another 8-12 hours are needed by a subset of the team to conduct the RRA assessment. In-scope internal and external network details will also need to be provided.