Cyber Assurance and Verification
Whoever built your security program, and whether or not that was us, this establishes on an agreed cycle that it is still operating. Not that the documents exist. That the control behind each one is working, with the evidence recorded.
A program was built. Controls were implemented, documents were written, findings were closed. Then twelve months passed and nobody checked whether any of it is still true.
Drift is not negligence. People leave, systems change, an exception granted for a week becomes permanent. The question is not whether it happened, it is which controls it happened to.
Five outcomes per control, cycle on cycle. Only one of them is a number going up.
A defined part of the program checked against the boundaries it set for itself: the controls in scope, the thresholds and review cadences your own policies commit to, and any actions agreed since. Recorded as operating, partially operating, or not evidenced, with the evidence behind each.
A working session with your sponsor and your IT provider or team. Decisions, blockers and next actions.
Risk register and action tracker kept current. Documentation updated as your business or the framework changes.
Progress, overdue items, what needs a decision from you, and next cycle's priorities.
Every third cycle the session widens to cover the program as a whole rather than individual actions.
This cycle against the last, per area, so the report says what changed rather than restating the position.
A control that was proven last cycle and cannot be demonstrated this one is the finding the whole arrangement exists to catch, and it is invisible to anybody starting fresh each year.
Quarterly, half yearly or annual, fixed at the start, with an initial term of three cycles so drift has time to show and be measured.
Where a cycle would find nothing, we say so. An assurance arrangement on a program that has not moved is a subscription rather than a service.
Most assurance is a repeat assessment with a discount. It re-establishes the position from scratch, which is expensive and tells you nothing about movement.
Here the baseline is held. Each cycle re-verifies against the same catalogue version and the same working papers, so the output is a delta: what improved, what regressed, what is newly in scope, and what cannot be compared because the control's meaning changed.
It also works on a program we did not build. Where we did build it, the report says so, because a reader is entitled to know which conclusions rest on our own prior work.
An assessment dated eighteen months ago answers a different question from the one a customer is asking today, and the gap between them is where contracts stall.
Underwriters increasingly rate on demonstrated controls rather than on a questionnaire. Evidence changes what cover costs and whether it is offered at all.
A control that quietly stopped operating costs a cycle to fix and a great deal more the year somebody else finds it.
Same counts, same catalogue version, cycle on cycle. Movement is the only figure that means anything above the IT function.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Yes, and that is the common case. We verify what is in place regardless of who put it there. Where we built part of it, the report names which parts, so nobody has to ask whether we were marking our own homework.
Quarterly where the environment changes quickly or a regulator expects it, annually where it does not. We would rather sell fewer cycles that find something than more that do not.
No. We issue no opinion and no certificate, because we are not an audit firm and nobody should pretend otherwise. What you get is verification with the evidence attached, which is what most people asking for an audit actually need.
Three cycles, so drift has time to appear and be measured, then reviewed at term. One cycle establishes a position; it cannot establish a trend.
Remediate what we find, monitor between cycles, or verify a control we implemented in the same cycle we implemented it.
If your program was assessed more than a year ago, the useful question is not what it scored. It is which controls have moved since, and that is answerable on a cycle rather than in a conversation.
Related services: Cybersecurity Program Development · Security Health Check · Third-Party Security Reviews