Cyber Assurance and Verification
Somebody outside your business has asked you to prove a control is working. We establish what is actually in place against evidence, document what is missing, specify what has to change, and verify the changes landed. You end with a program operating in the business rather than a report.
A customer, an insurer or your board has asked for proof. What exists is some combination of nothing documented, a folder of templates nobody follows, and a report from a previous engagement that went nowhere.
The gap is not knowledge. Your people know roughly what is missing. What is missing is evidence that anything is operating, in a form somebody outside the business will accept.
Each band is a subset of the one above it. The gap is what is left when proven is taken from assessed.
We establish what is actually in place, against evidence rather than assertion. Where the scale allows we inspect complete populations rather than samples: privileged accounts, leavers, mailbox rules and authentication records are all small enough in an organization of your size to review entirely, and a full population stands up far better when a customer audits you.
We deploy a documentation set and tailor every document to your industry, your regulatory position, your risk profile and your technology stack. Not a template with your logo on it.
We work with your IT provider or internal team to turn documents into operating controls, with an owner and a date against each action. We specify precisely what needs doing; they carry it out.
We establish which roles carry which risk and what each of them has to be able to do, then specify the training requirement: the role, the subject, the frequency, and what evidence of completion an assessor would accept. Courses are yours to procure. Where the capability is better built by doing than by watching, an exercise is training, and we run those ourselves: a tabletop exercise or a phishing simulation.
We confirm each agreed action is genuinely closed against the verification criterion set at assessment. A message saying the work is done is not sufficient. Where a control can only be proven by doing it, your team demonstrates it and we record what happened: a restore completed into a sandbox against its stated recovery time, an alert reaching an analyst queue, a leaver losing access. We do not need credentials on your systems to establish any of that. We need it done once, with us watching.
A core set for organizations starting from nothing, and the framework in full. Both are assessed the same way; the full scope covers more ground and takes longer to verify.
The scope is fixed in writing before anything starts, and what falls outside it is written down too.
Real counts from the shipped catalogue. DE.AE-01 and DE.AE-05 are withdrawn, so Detect counts eleven rather than thirteen.
Most assessments produce a judgement. Somebody experienced looked, and this is what they think. A year later nobody can tell whether a conclusion came from evidence or from an afternoon.
Here every control is a working paper: what was examined, across what population, what limitation applies. Complete populations where the scale allows, because evidence covering nine of fifty-eight accounts proves very little, and a stated sample with its basis where it does not.
That is why the scorecard counts what was proven rather than scoring you out of five. A maturity rating is a judgement about sophistication and we would be asserting it.
Security evidence is increasingly a gate on entering a procurement rather than a cost inside it. An organization that cannot produce it is not negotiating on price, it is not in the room.
Unevidenced controls become warranties, escrow and holdbacks when somebody buys or invests. A proven control costs nothing at that table; a believed one is priced.
Knowing which controls are proven and which are merely believed changes where the next budget goes. Most security spend is allocated against assumption.
Most compliance cost is repeat cost, because the first two attempts asserted rather than evidenced. The working papers and the catalogue version persist, so the next engagement measures change.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
It depends on scope and on how quickly evidence can be produced, not on headcount. The core set and the full framework are different sizes of the same engagement, and we fix the scope in writing before anything starts.
No. You get counts: how many controls are proven, how many are believed to be in place but cannot be demonstrated, how many do not apply. A rating out of five is a judgement about sophistication and we would be asserting it, which is the thing this engagement exists not to do.
No. Your own administrators produce any export, and you see the output before it leaves your network. We hold no credential into your environment.
You get it as a finding with a business consequence, a named owner and what would close it. What you do next is yours, including doing it yourself or giving it to your existing provider.
Implement the changes we specify, run penetration testing, or monitor anything. Each is a different engagement with a different independence position, and we say so rather than bundling them.
Score where you stand first. The readiness assessment is free, it takes eighty questions, and the result is yours to keep whether or not you ever engage anybody.
Related services: Cybersecurity Risk Assessment · Security Health Check · Cybersecurity Policy Creation and Development