Cybersecurity assessments for Belgian SMEs: web, penetration testing and infrastructure

01

Start with business activity and the services to protect

Your goal might be to check a portal before launch, prepare a takeover, examine an alert or improve continuity. These situations do not necessarily call for the same work. Name essential services, their users and the consequences of interruption or inappropriate access.

NIST CSF helps organisations structure cybersecurity risk management. Translate a supplier enquiry into decisions: which assets to examine, who can authorise checks and how fixes will be tracked. A list of tools does not replace these decisions.

02

Scanning, assessment, penetration testing or infrastructure review?

Cybersecurity assessment can describe very different activities. Ask what will be examined, which access is needed and what evidence will be produced. The following is Gaspa’s preparation framework, not a claim that the services are equivalent.

A penetration test may investigate attack paths within an authorised scope. Configuration or code review answers other questions. These approaches can complement each other when objectives, time and responsibilities are defined.

03

Web security: examine journeys and business rules

Describe user roles and sensitive operations: viewing a file, changing details, uploading documents or administering accounts. Interface visibility alone does not define the permissions required.

OWASP ASVS provides application security verification requirements. OWASP Top 10 2025 is an awareness document about major risk categories. One can help define controls; the other supports general understanding. Citing them does not certify a product or establish that an exhaustive assessment occurred.

04

Infrastructure and accounts: look beyond the public website

Applications depend on hosting, identity management, cloud services and suppliers. Examining only a public page may not answer who can administer the environment or restore a service.

Prepare an inventory of environments, administration accounts and essential dependencies. Record each owner and available evidence: configuration, procedure, exercise results or change records. Do not send passwords or sensitive exports through an initial enquiry.

An infrastructure review may examine access, planned segmentation, exposed services, patch follow-up and recovery arrangements. Adapt scope to the systems actually used and their owners’ authorisations.

05

Agree penetration testing rules before intervention

Testing must be authorised and agreed in writing with system owners. Identify targets, accounts, environments, intervention windows, permitted actions and stop conditions. Handle third-party services according to the agreements that govern them.

Define contacts for problems, data-handling conditions and arrangements for returning collected material. Agree an intervention level compatible with business activity. A broad assignment title should not be treated as permission to test every company system.

Preparation belongs in the scope and budget. It also establishes which access makes verification meaningful and what will remain outside the assignment.

06

Reports and remediation: what deliverables should you request?

A useful report connects findings with verified evidence and possible business impact. It explains limitations, separates assumptions from observations and identifies treatment options. Share sensitive annexes through an appropriate channel.

Request a prioritised action list with owners and dependencies. After changes, retesting should record what was checked, the result and unresolved items. A ticket marked fixed does not automatically verify that the intended outcome was achieved.

07

Cybersecurity budgets and support: compare the same scope

Cost depends on targets, user roles, environments, access, verification depth and deliverables. Separate preparation, assessment, reporting, remediation and retesting. We do not present a Belgian market average or a universal fixed-price package here.

Follow-up can organise decisions, hosting coordination, remediation tracking and further verification. Agree frequency, availability and responsibility. A one-off assessment does not itself establish continuous monitoring.

08

Prepare a cybersecurity assessment with Gaspa in Belgium

Start with your objective and environments. Gaspa examines web security requirements, penetration testing enquiries, infrastructure reviews and support arrangements. The proposal identifies contributors, scope, methods and agreed deliverables.

The UX and technical audit described elsewhere on this site has a different scope and does not include penetration testing by default. State cybersecurity needs explicitly. Do not provide secrets or sensitive documents before suitable sharing arrangements are agreed.