Risk Assessment vs Security Assessment vs Gap Analysis

We are inviting some potential external companies to perform a risk assessment for our organization, but the inquiries they are making appear to be more focused on security assessment and gap analysis pertaining to our infrastructure, firewalls, security solutions, policies, vulnerability assessment, penetration testing, etc. Therefore, we are wondering if it is necessary for these types of assessments to be included as part of a risk assessment.


If just risk assessment would be conducted how would that be identified and …

analysis assessment assessments companies cybersecurity etc external firewalls gap infrastructure making organization penetration penetration testing policies risk risk assessment security security assessment security solutions solutions testing types vulnerability vulnerability assessment