Define the audit
We agree objectives, systems, access, exclusions, evidence, cost, and whether any technical testing is appropriate.
Build a clearer picture of your cyber security position
A cyber security audit examines the controls, responsibilities, and working practices that protect your organisation, then turns the findings into practical priorities.
What the review can cover
We agree the systems, locations, risks, standards, and level of testing in scope before the audit begins.
- Identity and accessAuthentication, privileged access, account lifecycle, remote access, and how permissions are controlled.
- Devices and protectionManagement, patching, endpoint protection, encryption, and visibility across computers and other relevant devices.
- Email and collaborationControls intended to reduce account compromise, malicious messages, unsafe sharing, and avoidable data exposure.
- Data and resilienceBackups, recovery expectations, sensitive information, and the organisation's ability to continue after an incident.
- Policies and responseSecurity responsibilities, incident handling, supplier considerations, and whether documented expectations match practice.
- People and awarenessTraining, reporting routes, and the everyday behaviours that support or weaken technical controls.
When this assessment may help
Useful when responsibility is unclear, after significant change, before wider security work, or when leadership needs an understandable risk picture.
How the audit works
Nothing begins until the scope, information required, responsibilities, output, and cost are clear.
Review controls and practice
We examine the agreed environment and supporting evidence without extending into unapproved intrusive testing.
Report and prioritise
You receive clear findings, risk-based priorities, and recommended actions that can be taken internally or scoped separately.
Request a cyber security audit
Tell us what you need to understand and we will confirm a sensible scope before proposing any work.