Evidence behind each finding
Understand the issue, the evidence available and its potential effect on your business. We distinguish confirmed gaps from questions needing further investigation, and make the limits of the review clear.
Know where your security needs attention
Understand how your accounts, devices and data are protected, where the gaps are and what to tackle first. We review the agreed controls and explain the findings in plain language.
Review the protections your business relies on
Start with the systems, information and people that keep your business working. We agree the areas to review around your concerns, responsibilities and any specific requirements you need to address.
Accounts and access
Review sign-in protections, administrator privileges and remote access. Check how permissions are granted and removed, including access held by former staff and external providers.
Devices and updates
Examine how computers and other agreed devices are managed, updated and protected. Look at encryption, security software and whether the devices in use are accounted for.
Email and sharing
Review protections against malicious messages and account misuse, alongside the ways people share information. Identify settings or working practices that could expose data unnecessarily.
Backups and recovery
Check what is backed up, how backups are protected and what evidence exists of successful recovery. Compare those arrangements with how quickly the business needs its systems and information available again.
Responsibilities and response
Review who takes ownership when something goes wrong, how incidents are escalated and where suppliers are involved. Check whether documented procedures match what people would do in practice.
People and awareness
Look at the guidance people receive and how they report suspicious activity. Identify unclear instructions or everyday workarounds that make it harder for staff to work securely.
Turn findings into practical decisions
The findings should help you decide where to put your attention and budget. We agree the depth and format of the output before the review starts.
A clear order of action
Recommendations prioritised by risk and business impact, with issues needing early attention separated from longer-term improvements. See where changes depend on other systems, suppliers or further work.
Plan the improvements
Your team or existing provider can use the findings, or you can ask us to scope the changes. Implementation is agreed separately, with responsibilities and any disruption considered before work begins.
Agree the boundaries before work starts
The audit reviews agreed controls and evidence. We confirm the systems, authorised access, exclusions, timetable and cost in advance. Any intrusive testing requires a separate scope and explicit authorisation.
Define the review
Discuss your concerns and what the business depends on. Agree the checks, the evidence needed and who can authorise access to each system.
Examine the evidence
Review the agreed settings, records and working practices with the people responsible. Record what can be verified and where further information is needed.
Discuss the priorities
Walk through the findings and recommended actions. Clarify what needs early attention, what can be planned and which decisions need input from your team.
Start with the security questions you need answered
Whether you are unsure about access, recovery arrangements or inherited settings, tell us what prompted the review. We will help define a scope around the questions that matter to your business.