It's a scary world out there. All companies need to have some level of security around their data but many don’t have the resources to bring an expert onboard at $200,000 per year. For those companies, Tracc offers part time security officer (vCISO) services on a monthly basis tailored to fit their needs. Free from the salary and overhead of a senior level hire, many smaller companies find vCISO services affordable and efficient ways of dealing with security compliance, governance, reporting, management, and disaster planning. Tracc will audit the following CIS Top 20 Critical Security Controls and document the state of each control including a gap analysis of current vs. desired state. This information will be presented on a regular basis and include the following controls: 1. Inventory of Authorized and Unauthorized Devices 2. Inventory of Authorized and Unauthorized Software 3. Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers 4. Continuous Vulnerability Assessment and Remediation 5. Controlled Use of Administrative Privileges 6. Maintenance, Monitoring and Analysis of Audit Logs 7. Email and Web Browser Protections 8. Malware Defenses 9. Limitation and Control of Network Ports, Protocols, and Services 10. Data Recovery Capability 11. Secure Configuration of Network Devices such as Firewalls, Routers and Switches 12. Boundary Defense 13. Data Protection 14. Controlled Access based on the Need to Know 15. Wireless Access Control 16. Account Monitoring & Control 17. Security Skills Assessment and Appropriate Training to Fill Gaps 18. Application Software Security (including management of Code Reviews) 19. Incident Response & Management 20. Penetration Tests and Red Team Exercises (in process or planned)