Current-state assessment
We review technical controls, processes and people's awareness – three parts, none of which may be weak.
Roadmap and priorities
Cyber-security roadmap – knowing what to do first, and why
We assess the current state of your cyber security and give you a roadmap that orders the actions by budget and impact. It also works when certification is not on the table – the goal is security, not paperwork.
Who it is for
Who this service is for
- Companies that know something needs doing but not where to start
- Managers who need to justify a cyber-security investment in the budget
- Organisations that buy in IT services and want to know what is actually covered
- Companies for whom certification is not a goal but the risk is real
What is included
What the service includes
Creating the roadmap
Actions ordered by impact, cost and effort, with a timeline and owners.
Linking priorities and budget
A separate view of what can be done now and cheaply, and what needs an investment decision.
Representation in improvement procurement
We help write the requirements, evaluate bids and avoid buying a tool that does not solve the problem.
Process
How we work
Business context and risk appetite
What is the worst case for you? The roadmap is built around that, not around general fear.
Assessment
Interviews, document review and an overview of technical controls.
Prioritising the findings
Impact and likelihood for each finding – making it clear why one item is first and another is third.
Roadmap and presentation
A document and a presentation for management that can back budget and investment decisions.
Support during delivery
If you wish, we stay on to support delivery of the roadmap or take the security manager role.
Outcome
What you end up with
- A current-state assessment with concrete findings
- A prioritised roadmap with a timeline and owners
- A management summary that supports the budget decision
- Where needed, requirements and evaluation criteria for procurement
FAQ
Frequently asked questions
Does the roadmap assume we will go for certification?
No. The roadmap is meant precisely for those who want to improve security without a certification obligation. If you decide to certify later, the same roadmap serves as the starting point.
Do you also sell technical solutions?
No. We are not a reseller for any vendor and take no commission on solution sales – which keeps our recommendations independent. In procurement we represent your interests, not the vendor's.
How long does the assessment take?
For a smaller company usually a couple of weeks; for a larger and more distributed organisation, longer. We agree scope and timeline before starting, so there are no surprises.
Our IT partner says everything is fine.
That may well be true. An independent assessment gives you evidence of it – and if something is missing, it is better to learn it from us than from an incident.
Not sure where to start? Let's start with an assessment
The first conversation is free and without obligation. We will tell you honestly what you need – even when the answer is „not right now“.
See also
Related services
Information security audit and assessment
Independent assessment and an audit-readiness check.
Read more →Information security manager (CISO) as a service
Professional information-security leadership as a service – for companies that don't need a full-time security manager.
Read more →Training with phishing simulation
Information-security and safe-IT-use training for end users, with a phishing simulation.
Read more →