Independent security assurance and editable documentation to keep organizations secure, compliant and resilient Questions? contact@rootguardsecurity.com
Service 03 · Cycle agreed with you, then fixed

Roadmaps stall, and documentation decays

Each cycle we verify what has actually closed against its criteria, keep the documentation current as frameworks move, and report to you rather than to whoever did the work.

Cadence
Agreed with you, then fixed
Initial term
Three cycles
Reporting
To you, not your provider
Fee basis
Per cycle, fixed

The problem this solves

The roadmap is the part that decays

Work starts, some of it finishes, nobody independent checks, and a year later nobody can say what was actually closed. That is not a criticism of any team. It is what happens when the only person reporting on the work is the person doing it.

Your provider reports that the work is done.
Someone independent confirms it against a stated criterion.
The risk register was built once and never touched again.
It is maintained, with owners, dates and current residual exposure.
Your policies quietly go stale as frameworks move.
Documentation is updated and the change is recorded.
A customer asks and you scramble.
There is a current report saying what is closed and what is not.

What a month contains

Scheduled, not on call

Verification

A defined number of roadmap actions checked against the criteria agreed for them. Verified closed, partially closed, or not evidenced, with the evidence recorded.

Review

A working session with your sponsor and your IT provider or team. Decisions, blockers and next actions.

Maintenance

Risk register and action tracker kept current. Documentation updated as your business or the framework changes.

Management report

Progress, overdue items, what needs a decision from you, and next month's priorities.

Training access

Continuing access for your team, with completion recorded.

Quarterly review

Every third month the session widens to cover the program as a whole rather than individual actions.

This is a scheduled service. We do not monitor your systems, we do not receive your alerts, and we do not provide out-of-hours response.

Commercial terms

Easy to leave

The cycle is yours to set

Monthly suits an active roadmap with a lot moving. Quarterly suits a settled program where the question is whether anything has drifted. We agree which at scoping, in writing, and then it is fixed like everything else: the cycle does not change without your agreement, and neither does the fee.

Three-cycle initial term

Long enough to be worth starting, short enough that you are not committed to something you cannot judge yet.

Reviewed at term

We review at the end of the initial term so you can decide whether the work is worth the cost. Cycle by cycle after that, 30 days' notice.

Sold only where it applies

We do not propose this without a funded roadmap to verify. A retainer with nothing to check is a meeting you are paying for.

When to buy this

At the briefing, not six months later

The moment this earns its cost is when the findings are fresh and the roadmap has just been handed over. A few months on, the urgency has gone and the plan is in a drawer, which is the exact outcome this service exists to prevent.