Independent Cyber Assurance and Advisory
Three groups. Every engagement has a fixed scope, a fixed fee and a defined end date, agreed in writing before anything starts. Nothing is billed hourly and the scope does not move without your agreement.
The table below goes row by row. This is the shape of it.
It depends on what prompted the question rather than on what you think you lack. Find the row that is true of you.
| If this is true | The service | What you end up with |
|---|---|---|
| A customer sent a security questionnaire, an insurer wants specifics, or the board asked what protects the business | Cybersecurity Program Development | A documented program, evidence it operates, and a roadmap with named owners |
| You are fairly sure about multi-factor, leavers and backups, and want to know before committing to a full engagement | Security Health Check | Three controls examined properly in two days, with the working papers |
| You would be improvising if something happened tonight, or your plan has never been read aloud | Incident Response Planning and Readiness | A plan in force, playbooks, a tested team, and the gaps closed and verified |
| You have a roadmap from us or anyone else, and nobody independent has checked whether it still holds | Cybersecurity Risk Assessment | Verification of what actually closed, on a cycle you agree, with drift reported |
| Your policy suite is generic, or its thresholds are numbers nobody agreed and nobody meets | Cybersecurity Policy Creation and Development | Policies, standards and procedures calibrated to the estate you run |
| A regulator or a customer is asking about personal data and the answer would take a week | Data Protection Compliance Program | An obligation register with the evidence behind each entry |
| An assessment of your processing is owed, annually or for a specific project | Data Protection Impact Assessment | The assessment, a risk register, and every residual accepted by somebody named |
| A customer is asking what you do about your own suppliers, and the honest answer is not much | Third-Party Security Reviews | A register tiered by reach, assessments of the ones that matter, and a coverage position |
| The plan exists and nobody has walked it, or you cannot say who is allowed to disconnect a system | Incident Response Tabletop Exercise | Elapsed time per decision, and the points where the response stalled |
| You report a click rate and cannot say whether a report would reach anybody who could act | Phishing Simulation | Reporting rate, time to first report, and where the route breaks |
Establishing whether a control is operating, with the evidence recorded. These answer somebody outside the business who has asked for proof.
Three controls, two days, fixed scope
Assess, document, specify, verify
Whether you would see it, contain it, come back
Independent verification on an agreed cycle
Establishing and documenting your position on obligations, data and suppliers. The regime is a variable; the method does not change between them.
A suite calibrated to the estate you run
Obligations met in practice, not on paper
Residual risk rated, and accepted by somebody named
Tiered by what each supplier can reach
Crisis decision-making, exercised rather than advised on. These measure what a room does under pressure, which nothing else establishes.
One scenario, your people, on a clock
Whether a report reaches somebody who acts
Everything that could become an argument later is settled before day one.
You tell us what prompted the question. A questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes, not charged. If you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you supply, the fee and the end date. Nothing starts until you have it.
Delivered against that scope. Any change is agreed in writing first, including what it costs.
Deliverables, evidence and method, so the work can be repeated by somebody who is not us.
The fee is quoted rather than published, because scope decides it and a number carrying an asterisk is worth less than a straight answer. You own the output. Editable files, no platform, no license, no lock-in.
We do not configure systems, deploy software or make changes. Your IT provider or internal team does the work; we specify it precisely and verify it landed.
Separate specialties. We scope the brief, read the report and drive the findings to closure.
We are not a monitoring service. We will help you put that arrangement in place and confirm what it actually commits somebody to.
Where an obligation needs interpreting, that goes to your counsel, with the facts and the evidence attached.
We issue no certificate and no audit opinion. What you get is a position with the evidence behind it, which is what most people asking for a certificate actually need.
Where we produced a document or built part of a program, any later assessment of it says so. You are entitled to know which conclusions rest on our own prior work.
Your IT provider, a large firm, templates you deploy yourself, hiring somebody permanent, or us. Each is the right answer for somebody, and we would rather you picked correctly than quickly. See where each one wins and fails, including where we are the wrong choice.
Say what prompted it and we will tell you which engagement fits, or that none of them does. The conversation is not charged and it is not a sales call.
Also useful: Where we are the wrong answer · Common questions · Documentation packs