Public Office Hardening Bundle

The town's or court's computers, mapped to NIST CSF 2.0.

What it is

Runs twenty-seven checks on this computer, the network it is on, the devices it can hear and the domains you declare, asks your office's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.

A town, county, court or clerk's office is measured by its state, its insurer and the MS-ISAC review, and one forged payroll e-mail or a locked records system ends a resident's trust. This bundle gathers what one office can show: its workstations, the cameras and badge readers on its network, the records at rest and the doors they could leave through, your domain and website, and your own answers.

The framework

Mapped to NIST CSF 2.0 — with CISA's Performance Goals and the CJIS Security Policy by reference. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.

Who it is for

A town, county, district, court, clerk's office or state field office with its own computers and domain. A state agency or a federal office is measured organisation-wide under its own framework and is the human-delivered engagement's customer; this bundle is one office's first look and its framework reference is still correct for the workstation it ran on.

A state agency or a federal office is measured organisation-wide, under its state framework or under FISMA and NIST SP 800-53, with an authorisation that covers every system. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the workstation it ran on and is a useful first look for the IT lead who ran it.

What runs (27 checks)

• Windows Security Health Check (ENDPOINT-01)
• Ransomware Readiness Check (RANSOM-READY-03)
• Account & Access Review (INSIDER-ACCESS-05)
• Credential Hygiene Check (PW-HYGIENE-11)
• Out-of-Date Software Scan (EOL-16)
• Startup & Persistence Check (PERSIST-24)
• Wi-Fi & Home Network Check (WIFI-LAN-02)
• Router & Wi-Fi Settings Checklist (ROUTER-22)
• Email Spoofing & BEC Check (BEC-08)
• Breach & Identity Exposure Check (BREACH-10)
• Insider Risk Self-Assessment (INSIDER-21)
• Industry Readiness Questionnaire (READINESS-91)
• Internet Exposure Scan (EXPOSURE-06)
• Website & Storefront Checkup (STOREFRONT-07)
• Certificate & Encryption Check (TLS-09)
• Domain & DNS Security Check (DNS-63)
• Workstation Policy & Logging Check (POLICY-79)
• Removable Media & Cloud Sync Check (DATAEXIT-76)
• Sensitive Data at Rest Check (SENSDATA-78)
• Medical & Operational Device Scan (DEVICES-77)
• Business Impersonation & Typosquat Sweep (IMPERSON-19)
• Organizational Breach & Exposure History (ORGHIST-75)
• Cloud Storage Exposure Check (BUCKET-28)
• AI Usage & Shadow-AI Exposure Review (AIUSE-70)
• Digital Asset Register & Ownership Check (REGISTER-74)
• Hardware, Firmware & Removable-Media Check (ASSET-73)
• Active Directory Health Check (ADHEALTH-26) — runs only when you give the Windows domain this computer is joined to (leave blank if it is not joined to one)

Before it runs: two questions you can say no to

• May the Removable Media & Cloud Sync Check also read which cloud-sync clients are installed on this computer and which of your folders they hold? It never signs in to any account and never reads a file. Optional. Say no and the report records that this check was skipped at your request.
• May the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security or account number shapes)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.

Price

$549 one-time. Run it every 90 days as the Quarterly Public Office Hardening (IND-GOV-Q-87): $699 a year for four runs with a trend line on every check.

What it never does

It never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.