Security Assessment & Compliance

Security Assessment & Compliance

Know where you stand. Then stay there.

Security assessments and audits that rank what could genuinely hurt you, and hands-on help reaching a compliance framework — and holding it once the certificate is on the wall.

How to engage

Two ways in

Security assessment or audit

A point-in-time examination of your environment against a baseline, ending in a prioritized remediation plan you can hand to whoever is doing the work — us, your team or your existing provider.

  • Configuration and architecture review
  • Identity, access and privilege review
  • Vulnerability assessment
  • Policy and process review
  • Ranked findings with owners and effort estimates

Compliance program

Ongoing work to reach a framework and keep meeting it — gap analysis, closing what is missing, assembling evidence, and running the recurring tasks that keep the certificate valid between audits.

  • Gap analysis against the target framework
  • Control implementation and remediation
  • Policy and documentation authoring
  • Evidence collection and audit preparation
  • Recurring reviews so it does not lapse

Frameworks

What we work against

Most clients come to us because a customer, an insurer or a regulator has asked them for one of these. If your target is not listed, ask — the underlying work is largely the same and the mapping is usually the easy part.

  • SOC 2
  • HIPAA
  • PCI DSS
  • CMMC
  • ISO 27001
  • NIST CSF
  • NIST 800-171
  • CIS Controls
  • Cyber insurance questionnaires
We are not a certification body and we do not issue attestations. For frameworks that require an independent auditor, we do the readiness work and support you through their fieldwork — and we say so up front, because a provider who offers to both prepare and certify you is offering you something that is not worth much.

Related services

Two services that work well alongside this one

Managed Security

A SOC watching your environment 8/5 or 24/7, with your EDR and your identity threat detection and response run as a managed service rather than a console nobody has opened since it was installed.

Explore Managed Security

Physical Security

Camera systems and door access designed around your sites, then configured, maintained and supported as part of the wider technology estate.

Explore Physical Security