Cyber Assurance and Verification
Most health checks run a scan and hand back a spreadsheet of red, amber and green. This one takes three controls that fail quietly in almost every organization, establishes whether each is actually working, and gives you the record of what was examined. Narrow and deep, rather than broad and glanced at.
You are fairly sure multi-factor authentication is on, that leavers lose access, and that backups would restore. Fairly sure is the accurate description, and it is the one nobody says out loud.
A full assessment answers this properly and takes weeks. Most organizations want to know whether there is a problem before committing to finding out how big it is.
Each control is examined the way an assessor would, not the way a dashboard reports it.
Not whether it is switched on. Which accounts are excluded, whether legacy authentication still has a path, and who holds a break-glass account nobody reviews.
Exclusions are where this control fails, and they are invisible from a policy screenshot.
Your privileged access records reconciled against your leaver list, as a complete population rather than a sample.
Every organization believes this is clean. In the ones that check it usually is not, and the accounts that remain are the ones with the most access.
A restore attempted and timed, not a backup job report read.
A backup that has never been restored from is an assumption with a schedule attached.
We send the commands, your administrator runs them, and you see the output before it leaves your network.
No agent, no credential handed over, no access granted to us. What each command reads is written down before you agree to it.
A working paper per control: what was examined, across what population, and what that supports.
Plus the extracts themselves, so the work can be repeated by anybody, including somebody who is not us.
A health check normally means a scan and a spreadsheet. The scan finds what is visible from wherever it was run, the spreadsheet colours it in, and nothing in it survives being questioned.
These three controls were chosen because each one fails quietly, each produces a real finding in hours rather than weeks, and each is answerable from evidence rather than from opinion.
And three controls cannot produce a posture, so you get no score. A number implying otherwise would be worse than no number, and it is the first thing anybody sensible would test.
Whether there is a problem at all, before committing management attention to finding out how big it is.
Leaver access and multi-factor coverage are two of the three things a customer security review actually tests.
This is the control that is wrong most often, and the accounts that remain are the ones with the most reach.
If all three stand up, you have that in writing and you have spent two days rather than a quarter's worth of attention.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Then buy nothing. If you reconcile privileged access against leavers on a cycle and restore from backup regularly, this will tell you what you already know, and we would rather say so now.
No. Three controls will not answer what they are asking. Start with the assessment, or with the obligation itself if it is a privacy regime.
Because the scope is fixed and published. A call to establish what we are going to do is a call about something already decided.
Federated identity, or more than one forest or tenant, means establishing which system actually enforces authentication, and that is investigative work rather than extraction. It cannot be done honestly in two days, so we quote it separately rather than pretending.
You get the working papers and the findings, and what you do next is yours, including doing it yourself or handing it to your existing provider. If you go further, the fee comes off the assessment.
Two days, three controls, fixed scope, and a record you keep either way. If all three hold, that is worth knowing in writing.
Related services: Cybersecurity Program Development · Cybersecurity Risk Assessment · Incident Response Planning and Readiness