What a readiness assessment covers, what it costs, and why it saves money in the long run.
Most companies that fail their first compliance audit were not ready to begin. They started the formal audit process before understanding their gaps, and discovered expensive problems at the worst possible time, when the auditor is already engaged and the clock is running. A readiness assessment prevents this. Here is what it involves and why it is worth doing.
A readiness assessment is a structured evaluation of your current security posture against the requirements of your target compliance framework. It identifies gaps, prioritises remediation, and produces a realistic estimate of the time and cost required to achieve certification.
It is not a formal audit. No certificate is issued. The purpose is to give you an accurate picture of where you are before you commit to the full compliance programme, so you can make informed decisions about scope, timeline, and investment.
A good readiness assessment covers your policies and documentation, your technical controls, your organisational processes, and your evidence collection capabilities. It should produce a gap report with prioritised findings and a remediation roadmap.
The most common findings in readiness assessments are: missing or inadequate policies (most organisations have some policies, but they are often out of date, incomplete, or not aligned to the target framework); gaps in access controls (particularly around privileged access, offboarding, and MFA); inadequate logging and monitoring; and missing vendor management processes.
Technical findings vary by company. Cloud-native companies often have strong technical controls but weak documentation. More established companies often have good documentation but technical debt, legacy systems, unsupported software, and inconsistent configurations.
The readiness assessment also identifies quick wins, controls that are largely in place but need minor adjustments to meet framework requirements. Addressing these early builds momentum and reduces the overall timeline.
Companies that skip the readiness assessment and go straight to the formal audit typically encounter one of two problems: they discover significant gaps during the audit that require remediation before the audit can continue (adding cost and delay), or they achieve certification with a compliance programme that is not well-embedded in the organisation (creating ongoing maintenance problems).
The cost of a readiness assessment is typically £2,000 to £5,000 for a small to medium company. The cost of discovering a significant gap during a formal audit, in auditor time, remediation cost, and delay, is typically £10,000 to £30,000. The ROI is clear.
Netru's Readiness Assessment is designed to give you an honest, actionable picture of your compliance readiness in 2 to 3 weeks. It is the right starting point for any compliance programme.
Netru methodology