Cybersecurity audit and IT risk assessment in Corsica
A cybersecurity audit is a structured review of your tools, your access rights and your working practices. It measures your IT risks and ranks them by priority. We carry it out from Bastia for SMEs, startups or public bodies, then turn it into a realistic action plan that fits your means.
Security audit, risk assessment, health check, what is the difference?
The three terms describe related approaches of different depth. A security health check is a quick first snapshot, which spots the most visible weaknesses and whatever needs doing urgently.
A security audit goes further. It reviews how your workstations and servers are configured, along with the network and your accounts, backups, websites. Your working habits too. Each point is compared with recognised recommendations, such as those of ANSSI, the French national cybersecurity agency.
An IT risk assessment starts from your business, not from the technology. It identifies what matters most to you (your customer data, your invoicing, your online shop), what could happen to it and how serious that would be. It is what tells you where to invest first.
Unlike a penetration test, an audit does not try to exploit vulnerabilities. It looks at your organisation as a whole, to measure its risks.
When a cybersecurity audit becomes useful
- 01
You have never taken stock
Your IT has grown over the years, with several providers one after another. Nobody has the full picture.
- 02
Your business is growing
New staff, remote working, a second site, new online software. Every change means more access to keep an eye on.
- 03
You have received a questionnaire
A client, a public buyer or an insurer asks you to describe your security measures. You want to answer accurately.
- 04
After an incident
Once things are back to normal, an audit helps you understand what made the incident possible, so that it does not happen again.
IT risk assessment, examples by sector
- 01
Shops and trades
The till, the invoicing software, email, backups. What matters first is being able to keep working without losing your data.
- 02
Hospitality and tourism
Booking software, guest Wi-Fi, payments. What is open to the public has to be kept apart from what must stay internal.
- 03
Professional practices
Client or patient files, professional secrecy, GDPR obligations. Here, confidentiality comes before everything else.
- 04
Startups
Online services, developer access, user data. Laying good foundations from the start avoids costly fixes later on.
- 05
Local authorities and public bodies
Data about the public, continuity of service, staff spread over many sites. The assessment helps sort out needs that pull in every direction.
The stages of an IT security audit
As with any cybersecurity engagement, you authorise the scope and the planned technical checks in writing, beforehand.
- 01
Understand
Interviews with management and key staff, to get a sense of your business and tools, and of the providers you rely on. And of what you fear most.
- 02
Inventory
We list your devices and software, accounts, data, external access. This simple inventory often brings forgotten things to light.
- 03
Examine
We review configurations and access rights, the state of updates, backups, email. Remotely or on site, in Haute-Corse or elsewhere.
- 04
Assess
Each risk is weighed by its likelihood and its impact on your business, in the spirit of the methods published by ANSSI.
- 05
Report back
We present the findings in plain language and hand over the action plan, priorities included.
What you receive at the end of the security review
- 01
A management summary
A few pages, written to be read, that sum up your level of exposure and the decisions to make.
- 02
A map of your systems
A simple view of your systems and data, and of how they connect. It proves useful well beyond security.
- 03
A risk register
The list of risks identified with their severity, and the measures that reduce them.
- 04
A prioritised action plan
Quick measures first, to apply straight away. Then the larger pieces of work to schedule, each with the effort it will take.
- 05
What comes next
You are free to carry out the plan with your own team, with your usual provider or with us, as a hardening and remediation engagement. A follow-up review, on a date you choose, shows how far you have come.
Getting your audit right, the points to check
- 01
A clear scope
The whole business or a single site, internal IT alone or online services as well. Either way, the scope must be written down in black and white.
- 02
The right people available
An audit relies on interviews. Set aside time for management, and for the people who use the tools every day.
- 03
Your providers in the loop
Your managed IT provider, your host or your software publisher sometimes hold information that cannot be done without. Better to let them know.
- 04
Recommendations that fit
A plan that assumes a large group's budget will never be carried out. Insist on priorities that match your size.
- 05
A confidential report
It describes your weak points. Keep it somewhere safe and share it with very few people.
What determines the cost of a cybersecurity audit
The quote is drawn up after a first conversation, once the scope is defined. It depends mainly on the following.
- 01
Size of the organisation
The number of workstations and servers, of users, of physical sites.
- 02
Depth of analysis
A quick health check, a full audit or a detailed risk assessment.
- 03
Number of interviews
This depends on how many departments and people we need to meet.
- 04
Travel
Remote work or time on your premises, in Corsica or on the mainland.
- 05
Technical checks
A configuration review alone, or one backed up by targeted, authorised tests on certain systems.
Technologies and methods
- Risk assessment
- ANSSI recommendations
- Configuration audit
- IT system mapping
- Prioritised action plan
Frequently asked questions
What is the difference between an audit and a penetration test?
An audit examines your whole organisation, including technology as well as practices, to measure risk. A penetration test focuses on a precise scope. Through simulated attacks, all authorised, it checks what can really be exploited. The two complement each other.
Do we need an IT department to have an audit?
No. The audit is designed for organisations that do not have one. All it takes is someone who knows your tools day to day and, if you have them, your providers' contact details.
Will the audit disrupt our work?
Very little. Interviews are scheduled with you. As for the technical checks, most of them involve reading configurations, in agreed time windows.
Does the audit make us GDPR-compliant?
Not on its own. It covers data security, which is one of the GDPR's obligations, whereas compliance also involves legal and organisational matters. Our findings do, however, help you document your security measures.
What happens if you find a serious flaw during the audit?
We tell you immediately, without waiting for the final report, and point you to the protective measure to take first.