Define the audit
Agree objectives, systems, access, exclusions, evidence, and whether technical testing is appropriate.
A clear view of your cyber security position
Understand the controls already in place, the gaps that matter, and the actions worth prioritising.
What the review can cover
We agree the systems, locations, risks, standards, and level of testing before the audit begins.
- Identity and accessAuthentication, privileged access, account lifecycle, remote access, and how permissions are controlled.
- Devices and protectionManagement, patching, endpoint protection, encryption, and visibility across relevant devices.
- Email and collaborationControls that reduce account compromise, malicious messages, unsafe sharing, and avoidable data exposure.
- Data and resilienceBackups, recovery expectations, sensitive information, and the ability to continue after an incident.
- Policies and responseSecurity responsibilities, incident handling, suppliers, and whether written expectations match practice.
- People and awarenessTraining, reporting routes, and the everyday behaviours that support or weaken technical controls.
From scope to useful priorities
Nothing begins until the information required, responsibilities, output, and cost are clear.
Review controls and practice
Examine the agreed environment and evidence without extending into unapproved intrusive testing.
Report and prioritise
Receive clear findings, risk-based priorities, and actions your team can use directly.
Know what matters next
Tell us what you need to understand and we will confirm a sensible scope before proposing any work.