CMA Assessor Modules

Establish what an organization is actually willing to lose before assessing anything against a framework. Eighteen plain-language questions on money, downtime, oversight, and trust — no technical vocabulary — produce the acceptance thresholds that drive a risk register and POA&M, recovery time and recovery point anchors, a suggested insurance retention, and language for the minutes. Participants answer separately; the comparison view ranks where leadership disagrees.

Quickly determine how ready an organiation is to govern their AI security program and if a more in depth assessment is needed. Based on NIST RMF covering Govern, Map, Measure, and Manage functions for AI system risk and AI 600-1.

Quickly determine how ready an organization is to comply with the HIPAA Security Rule and/or if a more in-depth assessment is needed. Includes administrative, physical, and technical requirements for healthcare organizations.

Quickly determine how ready an organization is to meet CMMC Level 1 and/or if a more in-depth assessment is needed. Covers the 15 basic safeguarding requirements of FAR 52.204-21 (the 17 CMMC Level 1 practices) for contractors that handle Federal Contract Information (FCI).

Quickly determine how ready an organization is to meet CMMC Level 2 and/or if a more in-depth assessment is needed. Covers the 110 NIST SP 800-171 security requirements across 14 domains for contractors that handle Controlled Unclassified Information (CUI).

Quickly determine how ready an entity is to respond to an information security incident. Covering plan documentation, roles, detection, containment, communication, and regulatory notification obligations.

Pre-engagement readiness check for Ohio political subdivisions against ORC §9.64 - statutory adoption, incident reporting (OCIC/AOS), ransom restriction, and the NIST CSF 2.0 / CIS Controls v8 IG2 program baseline.

Workbook-driven HIPAA Security Rule risk analysis under §164.308(a)(1)(ii)(A). Send the client the plain-language workbook, then upload the returned .xlsx to score all eight sections, build the risk register and POA&M, and generate executive, full, or custom reports. Section structure follows the HHS SRA Tool 3.6.1; DOL EBSA best practices are mapped throughout.

NIST AI RMF 1.0 gap assessment across Govern, Map, Measure, and Manage, plus the NIST AI 600-1 Generative AI risk profile.

Assess for gaps in alignment with NIST 800-171 rev 2. For defense contractors and federal suppliers who handle controlled unclassified information.

CIS Controls v8 mapped to the NIST CSF 2.0 and the GLBA Safeguards Rule - coverage against current evidence for financial institutions and their service providers.

One structured interview of 120 plain-English questions, assessed simultaneously against the HIPAA Security Rule, CIS Controls v8, NIST CSF 2.0, and the HHS Cybersecurity Performance Goals. Produces per-framework posture side by side, a coverage matrix naming every control no question reached, an auditor answer sheet tying each score to the exchange behind it, and a roadmap sequenced so one fix closes the most ground across all four frameworks at once.

Upload the completed HB 96 Gap Assessment Workbook to produce a point-in-time gap assessment, an interactive check-listed remediation roadmap with owner/status tracking and a live completion score, an auto-generated risk register, and a client-ready report — mapped to ORC §9.64, CIS Controls v8, and NIST CSF 2.0.