Security Level Assessment
Evaluating current security maturity and identifying practical improvement priorities.
Understand the current state and define improvement priorities.
We review organizational, physical and technical controls for critical information infrastructure and business systems. The scope and criteria are defined from applicable laws, guidelines and assessment objectives.
We document gaps and evidence from document reviews, interviews and configuration checks. Impact, urgency and operating conditions inform improvement priorities and phased action plans.
Service scope
We provide field-tested assessments from administrative policy review through technical inspection of critical infrastructure.
Administrative security assessment
Review the operating effectiveness of security policies, organizational arrangements and personnel controls within the agreed targets and scope
- Review security policies and operating guidance against applicable current legislation
- Check security commitments and offboarding procedures for employees and external personnel
- Audit security management for outsourced work and cloud service use
Technical system vulnerability assessment
Analyze security configurations across servers, databases and network infrastructure
- Check accounts, permissions and patch settings in server OS environments (Linux/Windows) and DBMS platforms
- Review consistency of firewall, IPS, router and other network/security device policies
- Reduce the Attack Surface by identifying unnecessary open ports and services
Physical controls and environmental security review
Review physical access controls and disaster preparedness for computer rooms, restricted areas and backup facilities
- Verify access-control systems and visitor records for computer rooms and restricted areas
- Check fire, power and cooling preparedness and uninterruptible power supply (UPS) operation
- Review storage-media custody, movement controls and secure disposal procedures
Critical information infrastructure vulnerability assessment
Analyze technical and administrative vulnerabilities under Article 9 of Korea’s Information and Communications Infrastructure Protection Act
- Apply statutory assessment criteria for specialized security service companies designated by Korea’s Ministry of Science and ICT
- Quantify threats and risks affecting assets designated as critical information infrastructure
- Support protection implementation plans and advise on ministry audits and reporting
Assessment process and methodology
Agree the targets and criteria, review the current state, and develop an improvement plan.
01
Prepare and confirm scope
Identify the asset inventory and establish assessment criteria and an onsite schedule based on business impact and regulatory requirements.
02
Inspect and analyze vulnerabilities
Compare interviews with administrative and physical-security staff against evidence, and use configuration scripts and manual verification to identify technical weaknesses.
03
Assess risk and plan improvements
Quantify identified risks and develop practical protection measures covering immediate Quick-Win actions and annual improvements.
Frequently asked questions
How does a security level assessment differ from penetration testing?
A security level assessment reviews organizational and system controls against defined criteria. Penetration testing focuses on validating exploitability and impact through attack scenarios.
How are the scope and assessment criteria determined?
Targets and criteria are established from asset inventories, criticality, applicable requirements and assessment objectives. Methods such as document reviews, interviews and configuration checks are selected for the targets.
How can the results support improvement work?
We document identified gaps, supporting findings and improvement priorities. These help define items for early action and improvements to pursue in stages.
The scope of work and deliverables are determined by the target environment and the agreed engagement.
Start an objective, thorough security assessment
Use our experience as a government-designated specialized security service company to analyze system vulnerabilities and develop practical implementation measures.