A current-state review examines policies, operational evidence, control ownership and business context. Risk profiling considers both likelihood and impact, records assumptions and identifies who owns each risk. A maturity discussion helps leadership distinguish documented intent from controls that operate consistently.
Framework mapping may use NIST Cybersecurity Framework 2.0, ISO/IEC 27001 or CIS Controls when appropriate to the agreed objectives. Mapping is advisory and does not represent accredited certification or a formal certification audit. Applicable regulatory obligations should be confirmed with qualified legal or compliance advisers.
What we focus on
- Policy and control reviews
- Governance accountability
- Business impact and likelihood
- Control maturity analysis
- Budget prioritization
Clear, useful deliverables.
The final scope determines the deliverables included in your engagement.
- Risk register
- Maturity summary
- Control gap analysis
- Prioritized recommendations
- Implementation roadmap
A considered engagement process.
- 01Agree business context and reference framework
- 02Review evidence and interview owners
- 03Evaluate gaps and risk
- 04Validate assumptions with stakeholders
- 05Develop a staged roadmap
Your questions, answered.
What will we agree before work begins?
We define objectives, assets and data involved, access requirements, deliverables, exclusions and acceptance criteria. Availability and the delivery team are confirmed before a written scope is agreed.
What can our team expect to receive?
The agreed deliverables can include risk register, maturity summary, control gap analysis, prioritized recommendations, implementation roadmap. Recommendations identify priorities and next steps; implementation and follow-up are scoped separately unless included in the agreement.
How do we start?
Book an initial consultation to discuss gap analysis & risk profiling. The consultation clarifies needs and scope; it does not constitute a completed assessment, certification or implementation.