Security assessments & compliance support
A clear view of risk, and what to fix first.
We help leadership understand current exposure and give technical teams a prioritized improvement plan. Assessments can focus on one platform, a set of controls, or the broader security program, with follow-on remediation available.
Sidechain’s pen test uncovered three critical vulnerabilities our previous vendor missed entirely. The remediation plan was clear, prioritized, and our team had everything fixed within two weeks.
Assessments
Choose the assessment that fits the question.
Cyber Security Health Check
A 60-point review across common areas of exposure: email authentication, external vulnerabilities, web security, dark web credentials, endpoint posture, data risk, cloud configuration, and phishing susceptibility. Delivered as a written report with a ranked fix list.
Schedule a health checkVulnerability assessment
Scanning plus engineer review of the results. Findings ranked by risk, with a remediation list.
Cyber risk evaluation
People, process, and technology reviewed together: policies, controls, and architecture mapped against NIST CSF and the frameworks that apply to you.
HIPAA security risk assessment
Required by the Security Rule. Identifies risks to ePHI confidentiality, integrity, and availability, tied to an asset inventory and ePHI flow map. Audit-ready documentation for OCR.
Learn moreMicrosoft 365 security audit
Identity, email and collaboration, threat protection, data protection, governance, and licensing, with prioritized recommendations based on Secure Score and your available licensing.
Penetration testing
Finds what is exploitable, which a scan cannot tell you. In-house network, application, API, and AI testing with a live debrief.
Learn moreCompliance
Frameworks we support.
Deliverables include risk registers, findings reports, and recommendations for leadership discussions, customer due diligence, and audit preparation.
- HIPAA
- Healthcare organizations and business associates handling patient information.
- PCI DSS
- Retailers and any organization that stores, processes, or transmits payment card data.
- Financial sector
- Banks, mortgage companies, credit unions, and wealth management firms under state and federal security rules, including NY-DFS Part 500.
- SOC 2
- Organizations responding to customer due diligence on how they protect data.
- NIST CSF
- Any organization that wants a structured way to measure and improve its program.
Our work supports your compliance program. Certification and audit opinions remain with the appropriate independent parties.
Process
From engagement to roadmap.
Scope
Agree the systems, controls, and frameworks in scope, and what a useful outcome looks like for leadership and the technical team.
Assess
Interviews, configuration review, scanning, and evidence collection, with findings validated by an engineer rather than copied from a tool.
Report
An executive summary, technical findings with risk ratings, and a prioritized remediation roadmap. Debriefed live with your team.
Remediate
Optional follow-on work to close the gaps, connected to the findings that prompted it. Many clients continue into managed security.
Start with the Health Check.
Most clients finish it in under two weeks. Many use the results to decide what, if anything, to hand to us next.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon