Common Questions
Answered the way we would answer them on a call, including the ones with awkward answers. If what you need is not here, ask, and the answer goes on this page rather than only into your inbox.
It depends on what prompted the question. If nobody has asked you to prove anything, a documentation pack is probably enough. If a customer, an insurer or your board is asking for evidence rather than policy, that is an assessment. The ladder on the products page sets out what each one can actually prove.
No. Every document is complete and written, with bracketed fields where a figure or a name has to be yours. You are replacing values, not writing sections. Download one and see before you decide.
NIST CSF 2.0, ISO 27001, CIS Controls, SOC 2 Trust Services Criteria, CMMC Levels 1 and 2, and data privacy obligations. If the standard you are held to is not among them, you can commission a pack for it.
We record it. A control that cannot be demonstrated is reported as unproven, not softened. And if our honest view at the outset is that you do not need a paid engagement yet, we say so before you spend anything.
A report of every control assessed against the evidence behind it, a roadmap of what to fix in what order with named owners and verification criteria, and a briefing that goes through both. Not a score and not a certificate.
We specify what needs doing precisely enough for your team or your provider to carry it out, then verify it closed against the criterion agreed beforehand. We do not configure systems or deploy software, so a fixed scope stays fixed and the work sits with whoever knows your environment. Why that matters.
Yes. Editable files, yours to keep, with updates included. There is no platform to stay subscribed to and nothing stops working if you stop working with us.
Yes, and it is usually the right arrangement. They know your environment better than we will. The difference is who the report goes to: we report to you rather than to whoever implemented the controls.
No. Engagements are confidential and we will not list a client to win the next one. If a published reference list is what decides it for you, that is a fair reason to choose someone else.
Engagements are confidential in both directions, so we do not pass client details on. Judge the work instead: the free documents are the same standard we deliver to paying clients, and you can read every one of them before you talk to us.
Yes. Send us yours and we will sign it, or we will provide one. It is signed before we see anything of yours.
It is handled under whichever NDA is in force and deleted at the end of the engagement. We do not keep your evidence as a reference set, we do not reuse it on another engagement, and we do not need to hold it to stand behind the report.
Because a service fee depends on scope that has not been agreed yet, and a number with an asterisk on it is worth less than a straight answer. Scope, fee and end date are fixed in writing before any work starts, and none of them moves without your agreement. The packs are different: those are products and they carry a price.
No. Every engagement has a fixed fee against an agreed scope. If the scope changes, we agree that in writing first, including what it costs.
Not once it has been delivered, because the whole product is the content and you have it. That is why every pack has a free sample and the full document list is published before you buy. Read the sample first: if the writing is not what you expected, do not buy the pack.
If you had to search for something and could not find it, the page is wrong rather than the question. Tell us what was missing and it goes up here.
Also useful: Where we are the wrong answer · Free downloads · Notes