Assurance
Independent eyes on your controls and your suppliers.
Objective assessments, audits and exercises that show how well your security, continuity and incident response really work, and what to fix first.
What we do
Five ways to know where you really stand.
Each review is evidence-based and ends with clear, prioritised actions. Open any service to see what it covers.
01 Security assessments & control reviewsAn independent view of how well your controls work.
We assess your security controls against a recognised framework and your own policies, test whether they operate as intended, and show you where the real gaps are.
- Framework-based assessment (NIST CSF, CIS Controls or ISO/IEC 27001)
- Interviews, evidence review and sample testing
- Maturity rating by control area
- Prioritised improvement plan
You receive: an assessment report with maturity ratings and a prioritised action plan.
02 Independent internal audits (ISO 27001 & ISO 22301)The internal audit your certification requires, done objectively.
Certified organisations must audit their own management systems regularly. We carry out those internal audits independently, so findings are objective and ready for your certification body.
- Audit of clauses and Annex A controls
- Evidence sampling and interviews
- Nonconformity and observation reporting
- Follow-up of corrective actions
You receive: an internal audit report and tracked corrective actions, aligned to ISO 19011.
03 Third-party & vendor risk assessmentsKnow the risks your suppliers bring with them.
Your data is only as safe as the suppliers who handle it. We assess vendors before you sign and review existing ones, so third-party risk is understood and managed.
- Vendor risk tiering
- Security questionnaire design and review
- Evidence and certification checks
- Contract security requirements
You receive: a vendor risk register and an assessment for each supplier reviewed.
04 Business continuity & disaster recovery testingProve your recovery plans work before you need them.
A plan that has never been tested is an assumption. We run exercises that test your continuity and recovery plans against realistic scenarios and measure them against your recovery objectives.
- Tabletop exercises with key staff
- Disaster recovery and backup restore tests
- Checks against recovery time and point objectives
- Lessons learned and plan updates
You receive: an exercise report with results, gaps and recommended plan changes.
05 Incident response readiness reviewsBe ready to respond when, not if, an incident happens.
We review whether your organisation can detect, contain and recover from a security incident, from playbooks and roles to escalation and regulatory notification.
- Incident response plan and playbook review
- Roles, escalation and decision-making
- Regulatory notification requirements
- Tabletop exercise on a realistic scenario
You receive: a readiness report and a prioritised plan to close the gaps.
- WORK ALIGNED TO
- ISO 19011
- ISO/IEC 27001
- ISO 22301
- NIST CSF 2.0
- NIST SP 800-61
- CIS Controls
- NDPA 2023
- CBN Risk-Based Cybersecurity Framework
Questions
Assurance FAQs
How is a security assessment different from a penetration test?
A penetration test tries to break into specific systems. An assessment looks across your controls, people and processes to judge how well your security programme works overall. Many organisations use both.
Will we see the findings before the report is final?
Yes. Findings are discussed with you before the report is issued, so facts can be checked and context added, without changing the independent conclusions.
Can you audit an ISMS that we built ourselves?
Yes. Internal audits must be objective, and an independent auditor gives you findings your certification body can rely on.
Will a disaster recovery test disrupt our systems?
Tests are planned with your team. Many start as tabletop exercises with no system impact, and live recovery tests are scheduled in agreed windows with fallback plans in place.
Do you assess our suppliers directly?
We can design the questionnaire and review the evidence suppliers provide, and where your contract allows, take part in calls or site visits with them.
How is assurance work priced?
It depends on scope: the framework, the number of sites, systems, suppliers or plans involved, and the depth of testing. After a scoping call you receive a written proposal with a fixed scope and price.
Find out where you really stand.
Tell us what you need assessed and we'll set up a scoping call. We respond within 1 business day.