A method you can follow on paper.
No black boxes. Each stage of our work has a defined purpose, a named owner and a written output you keep.
Five stages
From first call to steady state
Most clients complete the first three stages within ninety days, then move into ongoing operation and reporting.
- 01
Listen
A working session with your leadership and technical staff to learn the business, the regulators involved and what is keeping people up at night.
- 02
Assess
A structured review of systems, controls and prior audit findings. You receive written findings ranked by risk, whether or not you continue with us.
- 03
Build
We implement in planned stages with named owners and dates, starting with the changes that reduce the most risk.
- 04
Operate
Day-to-day monitoring, maintenance and evidence collection by a team that knows your environment, with monthly reviews.
- 05
Report
Clear reporting for management, the board, auditors and examiners, and a roadmap that is updated as your business changes.
Principles
What you can hold us to
Evidence over assurances
If we say a control works, we can show the log, the test result or the ticket. Our reports are written to be checked.
Plain language
Security and regulation come with enough jargon. We explain risk and options in terms a board member can act on.
Your systems stay yours
Configurations, code, documentation and data live in your accounts. If you ever leave, you take everything with you.
Independent advice
We are not tied to a product vendor. Recommendations are based on what fits your institution and budget.
Deliverables
What you receive
Written assessment
Findings ranked by risk, with the evidence behind each one.
Responsibility matrix
Who does what between your team, ours and your other vendors.
Roadmap
Dated milestones, owners and budget, updated every quarter.
Monthly service report
Incidents, patch levels, backup tests and open risks in one document.
Evidence library
Audit-ready proof of each control, organized by framework.
Runbooks
Step-by-step procedures for incidents, recovery and routine changes.