Asset and software inventory
Devices, software, and cloud accounts reconciled into one list, so every safeguard has full coverage.
The Problem
Your Security Tools Are Licensed but Nobody Checks the Settings
Most small companies own decent tools: Microsoft 365 or Google Workspace, endpoint protection, a firewall. The gaps hide in settings nobody has checked and in assets nobody has listed.
01 · Asset list
Laptops on the finance list are missing from management.
We reconcile finance, identity, and device records into one asset inventory.
02 · Old access
Former contractors still hold admin rights.
An account and access review flags every admin without a current owner.
03 · Logging
Audit logs are on in one account only.
We check log settings on every cloud account and admin console in scope.
04 · Late discovery
You learn about gaps only when something breaks.
A scored safeguard list shows each gap before an attacker or insurer finds it.
Your cyber insurer asks whether you keep an inventory of every device and app. You think so, until the laptop list from finance shows machines that aren't in your management console. Two former contractors still have admin rights. Audit logging is on in one cloud account but not the other. Each gap is small on its own. Together they are exactly what an attacker looks for, and you only learn about them when something breaks.
We start with the inventory, because CIS Controls 1 and 2 decide whether every other safeguard covers all your assets. Then we score each safeguard as implemented, partial, or missing, using evidence from your admin consoles. Larger plans also check key systems against CIS Benchmark settings. You leave with a 90-day plan ordered by how attackers get in, not by the order of the PDF.
Inventory comes first
Devices, software, and cloud accounts are listed before any other safeguard gets a score.
Settings checked, not assumed
Evidence comes from your consoles and setting checks, not from answers to a questionnaire.
Fixes in attack order
Gaps ranked by how attackers use them, starting with accounts, patches, and backups.
Our CIS Controls Assessment Process
From IG Check Call to a 90-Day Fix Plan in Five Clear Steps
You approve the systems in scope and the evidence list first, review every safeguard score, and choose the fix order with us.
We ask about your size, systems, and data to confirm which Implementation Group fits. You get a scope, an evidence request, and a fixed price. If the free download from CIS and a self-review would cover your case, we'll tell you before we quote.
What's Included
What You Get With a CIS Critical Security Controls Assessment
An asset inventory, a scored safeguard list with evidence, setting checks on key systems, and a fix plan ranked by real attack risk.
Compare Options
DeveloperLook vs Self-Assessment vs MSP Review
A self-assessment is free and quick, and your MSP knows your systems well. Here is what each one checks and where gaps tend to slip through.
| Feature | DeveloperLookBest fit | Self-assessment | MSP review |
|---|---|---|---|
| Planning | Scope call and evidence list | Download it and start | Part of your contract |
| Evidence | Console exports and screenshots | Your own answers | Their own tooling |
| Independence | Outside view of your setup | Grading yourself | Grading their own work |
| Benchmark checks | Key systems vs CIS Benchmarks | Not included | Varies by provider |
| Asset coverage | Finance, identity, and device records | What you remember | Managed devices only |
| Speed | 1 to 4 weeks | Fastest to start | Quick if already scheduled |
| Support | 60 days of follow-up | Ongoing under contract | |
| Cost | Fixed price from $700 | Free to download | Often in your monthly fee |
DeveloperLook
Self-assessment
- Planning
- DeveloperLook: Scope call and evidence listSelf-assessment: Download it and start
- Evidence
- DeveloperLook: Console exports and screenshotsSelf-assessment: Your own answers
- Independence
- DeveloperLook: Outside view of your setupSelf-assessment: Grading yourself
- Benchmark checks
- DeveloperLook: Key systems vs CIS BenchmarksSelf-assessment: Not included
- Asset coverage
- DeveloperLook: Finance, identity, and device recordsSelf-assessment: What you remember
- Speed
- DeveloperLook: 1 to 4 weeksSelf-assessment: Fastest to start
- Support
- DeveloperLook: 60 days of follow-upSelf-assessment:
- Cost
- DeveloperLook: Fixed price from $700Self-assessment: Free to download
Projects We've Built
HR, Staffing, and Education Platforms We Have Built
Business platforms we built for HR, staffing, and education teams. Companies running systems like these are where IG1 and IG2 safeguards apply.
CognifyHR AI Recruitment Website and HR Dashboard
- HR & Staffing
- Technology
- Dashboard
Herile HR and Project Management Platform Website
- Business
- Dashboard
- SaaS Platform
Gradely E-Learning Website Design & Development
- Education
- Dashboard
- Membership Platform
Login HR Staffing App Design & Development
- HR & Staffing
- Portal
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why IT Leads Trust Us With Their Safeguard Scores
A safeguard score only helps if it matches reality. These habits keep the scoring fair and the fix plan small enough for a busy IT team.
Proof for every score
Every implemented safeguard has a screenshot or export behind it. When your insurer asks for evidence, you already have it on file.
Partial means partial
A safeguard that covers most laptops but not all of them is partial, not done. Honest scores point your budget at the right gaps.
Ranked by attacker use
We order fixes by how attackers actually get in: accounts, unpatched software, and missing backups first. Paperwork safeguards wait their turn.
We can also fix it
Our engineers set up MFA, inventories, and secure baselines, so recommendations stay practical. You don't get advice we couldn't carry out ourselves.
Read-only during the assessment
We ask for read-only roles in your consoles and change nothing during the assessment. Your production systems stay exactly as they are.
You keep the scorecard
The workbook, evidence, and plan stay in your tools. Your team can rescore each quarter without paying us again or starting over.
Overview
Who runs a CIS Controls assessment for a small or midsize company?
DeveloperLook runs CIS Controls assessments for small and midsize companies that want proof, not guesses. We build your asset inventory, score every IG1 safeguard with evidence, check key systems against CIS Benchmarks on larger plans, and deliver a 90-day fix plan. Assessments start at $700 with a fixed price and take 1 to 4 weeks.
DEVELOPERLOOK
Project facts · CIS Controls Assessment
- Service
- CIS Controls Assessment (asset inventory, safeguard scoring, Benchmark checks, fix plan)
- Typical timeline
- 1 to 2 weeks (IG1), 3 to 4 weeks (IG1 and IG2)
- Platforms
- Microsoft 365, Google Workspace, Windows, macOS, AWS, and Azure
- Built with
- CIS Benchmarks, Microsoft Intune, Entra ID, Google Admin console, Excel
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 60 days of follow-up questions after handover
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $700 USD, fixed scope after a free IG check call
Reviewed 23 Oct 2026 by Saimul Islam
Good fit
Companies without full-time security staff
Your IT is one person or an outside provider, and you want the CIS 18 controls narrowed to the safeguards that matter at your size.
Teams answering cyber insurance forms
Your insurer asks about MFA, backups, and asset inventories, and you want evidence ready before the renewal questionnaire is due.
SaaS firms facing security reviews
Your customers ask which CIS security controls you follow, and you want a scored list instead of a yes in a spreadsheet.
Companies growing past IG1
You hold sensitive customer data or run several offices, so IG2's extra safeguards now apply and you need to know the gap.
MSPs wanting an outside score
You manage IT for clients and want an independent CIS controls audit that shows them where they stand.
Not a fit
Need a formal attestation
A customer wants a formal attestation. CIS does not certify companies against the Controls, so SOC 2 Compliance Services fits that request better.
Want monthly upkeep
You want someone to keep safeguards in place every month. Managed Security Services runs your tools and scores IG1 monthly.
Only need a vulnerability scan
You only need to know which systems have known vulnerabilities. Vulnerability Assessment Services answers that faster and for less.
Budget under $700
Your budget is under $700. CIS publishes the Controls as a free download, and IG1 makes a sensible checklist for a first self-review.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for a CIS Controls Assessment
These are starting points in USD. Your final price depends on the Implementation Group, your offices, and any hardening work, and you get a fixed proposal after a free IG check call.
For small teams that need the 56 essential safeguards scored and ranked.
$700one-time, USD
- Asset and software inventory reconciled
- All 56 IG1 safeguards scored with evidence
- Account and access review
- 90-day fix plan with owners
- Rerunnable scorecard workbook
- 60 days of follow-up questions after handover
Recommended
For companies with sensitive data or several sites that need IG2 scored too.
$1,950one-time, USD
- Everything in IG1 Assessment
- 74 IG2 safeguards scored, 130 in total
- CIS Benchmark checks on up to 3 system types
- Service provider review for Control 15
- Mapping to NIST CSF 2.0 or your insurer's form
- Readout call with leadership
For IT teams that want us to close the biggest gaps, then score again.
$4,200one-time, USD
- Everything in IG1 and IG2 Assessment
- Device and software inventory tooling set up
- MFA and admin account cleanup
- Secure baseline on 1 system type
- Audit log settings on key systems
- Rescore 60 days after the fixes
For Agencies
White-Label CIS Controls Audits for MSPs and Agencies
You own the client relationship. We score your clients' safeguards, check their settings, and write the fix plan in your template, so your team can sell and deliver the fixes. Clients get an outside score without you hiring an assessor.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the client setup
Send the client's size, tools, offices, and why they need a score now.
- Client needs
- You share the details
- Details received
We set the scope
You get the Implementation Group, an evidence request, and a fixed price per client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Score and report
We score safeguards and deliver the fix plan in your template, ready to present.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Your logo on reports
Scorecards and fix plans go out under your brand and template.
One scorecard format
A shared workbook format, so results compare cleanly across clients.
Fixes your team sells
The plan lists fixes your own technicians can quote and deliver.
Fixed price per client
Every client score is quoted before work starts, which keeps your margin clear.
The Right Technology for Your Project
Technology Stack
Evidence comes from the consoles you already run, and the scorecard is a workbook your team keeps after we finish.
- Microsoft 365
- Google Workspace
- Okta
- Microsoft Entra ID
- Microsoft Intune
- Apple Business
- Android Enterprise
- 1Password
AWS- Microsoft Azure
Google Cloud
Cloudflare
- CIS Benchmarks
- Microsoft Excel
Google Sheets- Jira
FAQ
Frequently Asked Questions
Straight answers on cost, timelines, the 18 controls, Implementation Groups, and CIS Benchmarks.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
A CIS Controls assessment from DeveloperLook starts at $700 for all 56 IG1 safeguards, scored with evidence and ranked into a 90-day plan. Adding IG2 and Benchmark checks on up to 3 system types costs $1,950. With hands-on fixes and a rescore, it's $4,200. You get a fixed quote after the free IG check call.
An IG1 assessment takes 1 to 2 weeks, and adding IG2 takes 3 to 4 weeks. The inventory step sets the pace, because missing records slow down every safeguard after it. On the plan with fixes, the rescore happens 60 days after the hardening work is done.
The CIS Controls are a prioritized list of security safeguards published by the Center for Internet Security. Version 8.1 has 18 Controls and 153 Safeguards, written as concrete actions such as keeping an asset inventory or turning on MFA. That makes them easier for a small team to act on than broad, outcome-based frameworks.
CIS stands for the Center for Internet Security, the US nonprofit that publishes both the Controls and the CIS Benchmarks. The Controls started life as the SANS Top 20 and later took the Critical Security Controls name. The name changed over the years, but the idea stayed the same: a short, ordered list of defenses.
There are 18 controls in CIS Controls v8 and its v8.1 update, down from 20 in version 7.1. They hold 153 Safeguards split into Implementation Groups: IG1 has 56, IG2 adds 74, and IG3 adds the last 23. Most small companies start with IG1, which CIS calls essential cyber hygiene.
The CIS Critical Security Controls are the full name of the CIS Controls framework, a set of defenses ranked by impact. Version 8.1 added a Govern function to line up with NIST CSF 2.0. Each Safeguard is a specific, testable action, so it can be scored as done or not done.
In cyber security, CIS Controls are the practical layer under bigger frameworks, turning broad goals into specific settings and tasks. CIS publishes mappings to frameworks such as NIST CSF, ISO 27001, PCI DSS, and HIPAA. So one scored set of CIS cybersecurity controls can support several compliance efforts at once.
Start with IG1 and work through it in order, beginning with your device and software inventories. Next come secure configurations, account and access control, patching, backups, and logging. Early Controls make later ones possible, because you can't patch a laptop you don't know exists. Score first, fix the top gaps, then rescore.
Yes, each CIS Benchmark recommendation lists the Control, Safeguard, and Implementation Group it supports. Benchmarks are the how, with secure settings for products like Windows, Microsoft 365, or AWS. The Controls are the what. That's why our larger plans link each failed setting to the Safeguard it weakens.
After delivery, you own the scorecard, the evidence, and the 90-day plan, and you get 60 days of follow-up questions. Your team or IT provider can work through the fixes, or our engineers can do them on the top plan. Rescoring each quarter in the same workbook shows insurers and customers steady progress.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.