Independent Security Assurance, Done Right

How it works

From unproven to proven, in four steps

Getting started is simple. Every engagement has a fixed scope, a fixed fee and a fixed end date, agreed in writing before any work begins.

Step 1

Score where you stand

Take the free readiness assessment. Eighty questions, about ninety minutes, and a scored result you keep whether or not you ever engage us.

Step 2

Agree the scope

We confirm what is covered, what is excluded, what evidence we need and from whom. Signed before anything starts, so nothing later is a surprise.

Step 3

We assess and document

Controls assessed against evidence rather than assertion, and a documentation set deployed and tailored to your environment. Editable files, yours to keep.

Step 4

We verify it closed

Each agreed action checked against a stated criterion. A message saying the work is done is not sufficient, and this is the step most engagements leave out.

Why RootGuard

Three things that do not change

There are no fill-in-the-blank sections in our documentation and no generic templates with a logo dropped on top. Everything is written by practitioners who run security operations and sit real audits, and tailored to the technologies and obligations you actually have.

Independence

We report to the business rather than to the party that implemented the controls. We do not configure systems, resell products or take vendor commission, so there is no finding we benefit from making and none we benefit from softening.

Evidence

We ask for the export, the report, the record. Where the scale allows we inspect complete populations rather than samples. A control that cannot be demonstrated is recorded as unproven and reported as a finding.

Ownership

Documentation is delivered as editable Word and Excel files with updates included. No platform to log into, no subscription required to keep your own policies, and no lock-in of any kind.

Our products

Editable documentation for every situation

Editable, audit-focused documentation mapped to the frameworks your customers, insurers and regulators actually ask about. Every pack carries a free sample and the full document list.

Our services

Three engagements, each with a defined end

Documentation proves a program exists. An assessment establishes whether the controls behind it operate. Buy one service, or run them in sequence.

Free tools and guides

Fourteen free resources, and none of them need an account

Self-scoring workbooks and complete production-ready documents, built to the same standard we deliver to paying clients. No account, no card, no email required, and the four below are only the start.

Complete the readiness assessment, send us the result, and we will spend forty-five minutes going through it with you at no charge. If our honest view is that you do not need a paid engagement yet, we will say so. These tools are self-reported and unverified, and we say so on the front of them: they record what you believe about your controls. Establishing what is true is the paid work.

Documentation lifecycle

Security documentation has a shelf life

Contacts change, systems change, the person who knew the runbook leaves, and frameworks are revised. If your documentation is old enough to attend school, it needs a thorough review rather than a tidy-up.

Our Program Support service exists for exactly this. Each month we verify a defined number of roadmap actions against their criteria, keep the register and the documentation current, and report to you rather than to whoever did the work.

Product categories

What maps to which framework

Each category includes professionally written, editable documentation and, where you want it verified, the assessment that establishes whether the controls behind it operate.

Industries served

Built to scale, from a single office upward

A standard is a standard for a reason, and that applies regardless of company size. Our documentation is written to industry-recognized practices and right-sized to the organization in front of us.