← Back to Products
Internal — not a client deliverable
Vigil Certus / Pontis Systems

CIS Controls v8 IG1 Gap Assessment

Run by Vigil Certus on Pontis Systems (Sole Epic LLC) itself, doubling as a real internal readiness upgrade and the working template for client engagements.

Entity: Pontis Systems (Sole Epic LLC), Leander, TX Framework: CIS Controls v8, IG1 Stack: Google Workspace + GoHighLevel

Intake Summary

Why This Matters Right Now

Pontis Systems sells recurring services to other small businesses, some of which will eventually ask a version of "how do you protect our data" before signing or renewing, especially as QuoteDrop and Voice Agents clients scale. There's also a standalone driver: this exact gap assessment format is the Dream 100 deliverable used to open conversations with Vigil Certus prospects. Running it on Pontis first means it doubles as a real internal upgrade and a working sample to show prospects.

Gap Assessment Against CIS Controls v8, IG1

Rated Present / Partial / Absent based on intake. IG1 has 56 safeguards across 18 controls; this covers the ones most relevant to a solo, cloud-based operation. Safeguards not applicable to a one-person, no-physical-hardware-inventory business are marked accordingly rather than scored.

ControlSafeguardStatusNotes
1. Inventory of Enterprise Assets Maintain asset inventory Partial Devices used to run the business exist but aren't documented anywhere
2. Inventory of Software Assets Maintain software/SaaS inventory Absent No running list of what SaaS tools hold business or client data (Google Workspace, GHL, payment processor, any others)
3. Data Protection Data inventory and classification Absent No documented list of what client data is collected, where it lives, or how long it's retained
3. Data Protection Encrypt data at rest and in transit Present (inherited) Google Workspace and GHL both encrypt in transit and at rest by default; not independently verified or documented
4. Secure Configuration Secure default configurations Partial No documented baseline for account settings across Google Workspace/GHL
5. Account Management Unique accounts, no shared logins Present Solo operator, no shared credentials by default
5. Account Management Disable dormant/unused accounts N/A yet No employees or contractors currently with system access
6. Access Control Management MFA on all accounts Present Confirmed across email, GHL, payment processor
6. Access Control Management Centralized access control N/A yet Solo operator; becomes relevant the moment a VA or contractor is added
7. Vulnerability Management Patch management Partial Cloud SaaS tools patch themselves; no process exists for reviewing third-party app permissions or plugin updates
8. Audit Log Management Enable and retain audit logs Partial Google Workspace and GHL both generate logs by default; nothing is being reviewed or retained intentionally
9. Email/Browser Protections DNS filtering, anti-phishing Absent No DMARC/SPF/DKIM verification confirmed for the business domain, no browser-level protections documented
10. Malware Defenses Anti-malware on all endpoints Absent No confirmed endpoint protection on devices used to run the business
11. Data Recovery Automated backups, tested recovery Absent No documented backup of GHL data, client records, or business documents outside of vendor-side retention
14. Security Awareness Training Security awareness program Absent None needed yet for solo operation, but becomes a real requirement the moment a contractor or VA is added
15. Service Provider Management Inventory and assess service providers Absent No documented list of vendors with access to client or business data (Google, GHL, payment processor, any others)
17. Incident Response Management Written incident response plan Absent No plan exists for what happens if an account is compromised or data is exposed

What This Actually Means, in Plain Terms

The two encouraging findings: MFA is genuinely in place everywhere, which is the single highest-leverage control and the one most solo operators skip. And the core platforms (Google Workspace, GHL) provide strong baseline encryption and logging by default, so the underlying infrastructure isn't the weak point.

The real gap is documentation and process, not technology. Nothing here requires buying new tools. It requires writing down what already exists, adding backups, and building the two or three processes that matter most before they're urgently needed, specifically before adding a contractor or VA, and before a client or partner asks for proof.

Prioritized Remediation Roadmap

Do first (this month, low effort, highest leverage):

  1. Turn on automated backup/export for GHL data and business documents. This is the single largest actual exposure right now, since there is currently no recovery path if GHL access is lost or an account is compromised.
  2. Verify SPF/DKIM/DMARC are correctly configured on the sending domain. Directly affects email deliverability for cold outreach campaigns and closes a phishing/spoofing gap.
  3. Write a one-page software/SaaS inventory: every tool with access to client or business data, what data it touches, who has login access.

Do next (before adding any contractor or VA):

  1. Draft a written information security policy (even a short one) covering account access, data handling, and device use.
  2. Draft a one-page incident response plan: what to do first if an account is compromised, who to notify, how to rotate credentials.
  3. Set up endpoint protection on the primary device(s) used to run the business.

Do before it's asked for (positions Pontis/Vigil ahead of a client or partner request):

  1. Build a vendor/service provider inventory documenting what Google, GHL, and the payment processor do with client data, and where their own compliance posture stands (SOC 2 status, etc.), since this is exactly the kind of question Vigil Certus clients will eventually be asked and it's worth Pontis modeling the practice.
  2. Establish a quarterly review cadence: revisit the software inventory, confirm backups are working, confirm MFA is still enforced everywhere.

Evidence Folder Starter

Once the items above are complete, the following should be kept on file and easy to produce on request:

Note on use as a Dream 100 artifact: This same structure, intake through remediation roadmap, is what gets run for a real prospect: swap the entity details, adjust for actual team size and stack, and the format holds. The gap between "informal but reasonably careful solo operator" (this result) and "documented, evidence-ready operator" is exactly the gap Vigil Certus sells closing.