Why RootGuard
Your IT provider, a large firm, templates you deploy yourself, or hiring somebody permanent. Each is the right answer for somebody, and picking correctly matters more to you than picking us. Here is where each one wins, where each one fails, and where we are the wrong choice.
Set out so you can rule us out quickly if another route fits better. Three meetings in is an expensive place to discover it.
| Option | Where It Wins | Where It Fails |
|---|---|---|
| Ask your IT provider | They know your environment, they are already engaged, and it costs nothing extra. | The report comes from the party that built and runs the controls, so a customer, insurer or board asking for an independent view will not accept it. |
| A large accounting or consulting firm | Brand recognition that satisfies procurement, deep bench, international footprint. | Fees an order of magnitude higher, a team you did not meet at the pitch, and a scope shaped to their methodology rather than your business. Rarely interested in engagements of this size. |
| Buy templates and do it yourself | Cheapest by a wide margin, fast, and you keep full control. | Documentation proves intent, not operation. Nobody independent has checked, so you still cannot answer the question that prompted the purchase. We sell these too, and say the same thing on the product page. |
| Hire a security manager | Permanent capability, institutional knowledge, available every day. | A salary, a long recruitment, and the same independence problem: the person building the program is the person reporting on it. Most organizations of this size cannot justify the role yet. |
| RootGuard | A fixed fee, a fixed scope and an agreed end date. You keep every document, and agreed fixes are verified closed against criteria set before the work starts. | Implementation, monitoring and round-the-clock response sit with whoever provides them, and we work alongside them. Engagements are confidential, so there is no client list to call. |
The usual risk with a small practice is narrow expertise: somebody who knows a framework and cannot read a configuration. Four domains are covered here, and the assessment reaches into all of them.
Whether a control is well designed, not merely present. Most findings that matter are design findings: the control exists, and it was built to fail quietly.
CISSP · CISSP-ISSAP · CISM
Where mid-market data actually sits, and the obligations that attach to it. A cloud tenant and a privacy regime are the same question asked twice.
CCSP · CDPSE
What an attacker would do, and what evidence a system leaves behind. This is why populations get examined rather than sampled: knowing what a log can prove decides what an assessment can claim.
SC-200 · CEH · CHFI
The layer most assessments skip, because the assessor cannot read it. Identity, network and endpoint configuration is where a policy either holds or does not.
SSCP · CCNA Security
Six things, and each one is checkable rather than asserted.
Your team or your provider configures; we determine what the evidence shows and record it. That separation is what lets a customer, an insurer or a board take the finding at face value.
The people who assess your controls are accountable for the findings and reachable afterwards. You know who they are before the work starts, and the same people are there at the briefing and a year later.
We ask for the export, the report, the record, and examine complete populations where the scale allows. A finding built that way stands up when a customer, an insurer or a regulator tests it.
Each action is checked against the criterion agreed at assessment. A message saying the work is done is not sufficient, so you end with confirmation rather than a report of confirmation.
Editable files, updates included, no platform and no subscription required to keep your own policies. What we produce remains yours whether or not you work with us again.
If our view after the free review is that you do not need a paid engagement this quarter, we say so. You get a clear answer either way, which is what makes the free review worth taking.
Stated plainly, so you can decide quickly rather than discovering it three meetings in.
Engagements are confidential in both directions and we will not name you either. If a published reference is the deciding factor, weigh that honestly. What you can judge instead is free work, on its own merits.
We specify precisely what needs doing and verify it was done. Your team or your provider carries it out. If you want a single supplier for everything, we would be part of that arrangement rather than all of it.
We prepare you for an incident and will help you put a round-the-clock arrangement in place, but we do not run one. That is a different capability with different obligations.
Nobody certifies most of what we assess, and we are not an audit firm. What you get is a position with the evidence behind it, which is what most people asking for a certificate actually need.
Brand recognition is a real requirement in some organizations and it is not one we can meet. Where that is the deciding factor, the decision is already made.
If we produced a document or built part of your program, a later assessment of that work says so. Some buyers would rather that work were assessed by somebody with no history of it, and that is a reasonable position.
The test of a report is whether it survives being read by somebody who was not in the room and has no reason to be generous.
The artifact, its date, the population examined and any limitation on it. A reader can trace any conclusion back to what was looked at, rather than taking it on trust.
Each action carries a criterion agreed before the work started, written so a third party could confirm it was met. Not "improve access management" but a condition with a pass and a fail.
What was not covered, what could not be evidenced, and what a single engagement cannot establish. A report that claims more than it examined is the one that fails under questioning.
Take the free readiness assessment, send us the result, and we will spend forty-five minutes going through it at no charge. You will know within the hour whether our reasoning is worth paying for, and it costs you nothing to find out.
Also useful: The whole portfolio · Common questions · Free resources