Independent Cyber Assurance and Advisory
We establish the answer against evidence rather than assertion, and give you the proof to put in front of a customer, an insurer or your board. Fixed scope, fixed fee, defined end date, and everything we produce is yours to keep.
Somebody says the control is in place. Usually they are right, and usually nobody has checked. A setting exists, which establishes a point in time rather than that the control operates across the whole population, over a period, for everyone.
Most gaps live in that space. Not in controls nobody thought of, but in controls everybody assumed were working. The question that exposes it is never technical: it is a customer sending a questionnaire, an insurer asking at renewal, or a regulator asking after something has already gone wrong.
An assessment does not score you. It puts every control in one of these, records what was examined to get it there, and hands you the working papers. The two in the middle are what a customer, an insurer or a regulator is actually testing for.
The evidence gap is the share of your program resting on assertion. It is the number most organizations have never seen.
Organizations of this size are rarely careless about security. They buy the tools, they engage a provider, and somebody is nominally responsible. These are the four places that still comes apart.
01
Somebody asks you to demonstrate a control and the honest answer is that nobody has ever checked. Not because you are careless, but because until the question arrived there was no reason to.
We establish it against evidence and record what was examined.
02
The party that built and runs your controls is the party reporting on them. A customer, an insurer or a regulator discounts that report, and they are right to.
We report to you, and we do not implement or monitor anything.
03
An assessment describes one day. People leave, systems change, an exception granted for a week becomes permanent, and nobody notices which control moved.
We hold the baseline and report the delta, cycle on cycle.
04
A policy set with thresholds nobody agreed is a documented breach of your own rules. Generic documents fail the first time somebody reads them properly.
We calibrate every interval, threshold and owner to what you can sustain.
Somebody has asked you to prove a control is operating. These establish whether it is, with the evidence recorded.
Three controls, two days
Assess, document, specify, verify
See it, contain it, come back
Verified on an agreed cycle
A regulator, a customer or a parent company is asking about data, documents or suppliers. These establish your position and the evidence behind it.
Calibrated to your estate
Obligations met in practice
Residual risk, named and owned
Tiered by what they reach
Crisis decision-making, exercised rather than advised on. These measure what a room does under pressure.
One scenario, on a clock
Does a report reach anybody
Every engagement has a fixed scope, a fixed fee and a fixed end date, agreed in writing before any work begins. Nothing is billed hourly and the scope does not move without your agreement.
The first conversation is not charged and it is not a sales call. If our view is that you need less than you thought, or somebody else entirely, that is what you will hear. Where we are the wrong answer.
We report to the business rather than to the party that implemented the controls, and we do not implement or monitor anything ourselves.
We ask for the export, the report, the record. Every finding carries what was examined, across what population, and any limitation on it.
Editable files, no platform, no subscription, no lock-in. Everything an engagement produces is yours, including the evidence and the method.
Six complete, editable documentation sets, each mapped to the framework somebody is actually asking you about. Deploy one yourself today with no conversation required, or have it rewritten against the systems you run.
Documentation proves intent. Only an assessment proves the control behind it is operating, and knowing which of those you need is worth more than either.
A standard is a standard for a reason, and that applies regardless of company size. The work is right-sized to the organization in front of us rather than cut down from an enterprise template.
Credit unions, lenders, brokers, accountants
Law firms, consultancies, agencies
Contact centers, shared services, back office
Software, managed providers, hosting, integrators
Clinics, diagnostics, care providers
Multi-site operators taking card payments
Take the free readiness assessment, send us the result, and we will spend forty-five minutes going through it at no charge. You will know within the hour whether our reasoning is worth paying for, and it costs you nothing to find out.
Also useful: The whole portfolio · Where we are the wrong answer · Free downloads