Know whether you could detect and respond to an attack before an auditor asks
A structured assessment of your security operations readiness — logging, detection, alerting, response and evidence — mapped to the monitoring and incident-management criteria in SOC 2 (CC7), ISO 27001 Annex A and CIS Controls 8, 13 and 17. You get a scored report, a gap list and a 90-day roadmap.
$497
Book my assessment — $497 Talk to us firstWhat is assessed
Visibility
- Which log sources exist (identity, endpoint, cloud, network, SaaS) and which are missing
- Retention, time sync and tamper resistance
Detection
- Alert coverage against common attack techniques
- Tuning, false-positive load and ownership of alerts
Response
- Incident response plan, roles, escalation and communications
- Containment capability: isolate a host, disable an account, revoke tokens
Evidence & governance
- Can you prove monitoring happened? Reports, tickets, reviews
- Mapping to SOC 2 CC7.1–CC7.5 and ISO 27001 A.5.24–A.5.28, A.8.15–A.8.16
How it works
Scope, systems inventory and access to read-only views of your tools.
TenGrid Security reviews configurations, sample alerts and your response documentation.
Scored report, prioritised gaps, and a 90-day plan you can run in-house or with us.
"SOC" here means Security Operations Center readiness. Where relevant we map findings to SOC 2 criteria so the same work supports an audit, but this assessment is advisory and does not produce a SOC 2 report — that is issued only by a licensed CPA firm.
Deliverables
- Readiness score (0–100) across visibility, detection, response and evidence
- Gap register with severity, effort and owner
- Log-source coverage matrix
- 90-day roadmap with quick wins in the first 30 days
- Optional: results loaded into a Security Posture Dashboard
Questions
Do we need a SIEM already?
No. Many clients have only Microsoft 365 / Google Workspace and endpoint logs. The assessment tells you whether a SIEM or MDR is warranted.
Company size?
Best fit is 15–500 staff. Larger environments are scoped under the Full Compliance Consulting Engagement.
Is this a penetration test?
No. It evaluates whether you would see and respond to an attack, not whether one succeeds.