Abstract: A method, system, and apparatus for facilitating the process of a corporate risk assessment procedure (which may be identified as an “ESA” or “Enterprise Security Assessment”) are disclosed. A method for data gathering and security assessment may allow security assessors to more readily combine the results of a documentation review process and the results of client interviews, and associate those findings with a broad set of sector-specific and international cyber security standards. This method may include aggregating both sets of data, displaying the aggregated data to the security assessor or another party in a convenient manner, executing functions on the data to transform it into a useful form, and electronically comparing the data to one or more cyber security standards. Data may then be communicated back to a user in the form of an electronic or hard-copy report. A system and apparatus may likewise be configured to perform these steps.