Enterprise Services • ES-01
Cybersecurity Assessment & Assurance
Establish what the control environment actually does, not what the policy says it does.
Scope
What the engagement covers.
Most organizations have controls on paper, tooling in production and no reliable view of whether the two match. This service produces an evidence-based picture of control coverage, effectiveness and residual risk against a chosen framework.
Included capabilities
- Maturity assessment against ISO 27001, NIST CSF, CIS or sector regulation
- Technical validation: configuration review, vulnerability assessment, penetration testing
- Cloud and identity posture review across the estate
- Third-party and supply-chain control assessment
- Residual risk statement with prioritized, costed remediation
Outputs and deliverables
- Control maturity report with per-domain scoring
- Technical findings register with severity and proof
- Prioritized remediation roadmap with effort and cost bands
- Board and audit-committee summary pack
Workflow
How it is delivered, step by step.
Each step has an owner, an entry condition and an artefact that has to exist before the next step begins.
01ScopeFramework selection, asset boundary, exclusions and evidence expectations.
02CollectDocumentation review, interviews, configuration extracts and tool telemetry.
03TestSample-based control testing plus targeted technical validation.
04RateEffectiveness rating with evidence trail per control and per finding.
05ReportFindings, risk statement, roadmap and board-level summary.
Use cases
Where this is typically applied.
Post-incident assurance that remediation actually closed the gap
Due diligence before or after an acquisition
Delivery model
The operating pattern for Enterprise Services.
The same delivery discipline applies across every capability in this line, so combined engagements stay coherent.
Assess
Current state, obligations, control coverage, gaps and material risks.
Design
Target architecture, control library, policy set, roles and evidence model.
Implement
Build controls into platforms, workflows and delivery pipelines.
Operate
Run the function, or coach the client team while they run it.
Assure
Independent testing, reporting to committee and continuous improvement.
Integration
- Existing GRC, ticketing and ITSM platforms for issue and action flow.
- SIEM, EDR and cloud posture tooling for control evidence.
- HR and identity systems for role, joiner-mover-leaver and access review data.
- Board and committee reporting cycles, so output lands in existing governance.
Engagement approach
Engagements start with a fixed-scope assessment so the client sees findings before committing to a build. Implementation runs in quarterly increments against an agreed roadmap, and any managed element carries a named lead, defined SLA and quarterly service review.
Related
Other capabilities in Enterprise Services.
ES-02
Security Architecture & Transformation
Design the target state, then sequence the journey so each step is fundable and reversible.
ES-03Incident Readiness & Response
Decide how you will respond before the day you have to.
ES-04Privacy / PDP Programme
Turn personal data protection law into operating routine rather than an annual scramble.
ES-05DPO as a Service
A named, qualified data protection officer function without the cost of building one internally.
ES-06Privacy by Design
Put privacy requirements into the build, where they cost least to satisfy.
ES-07AI Governance
Give AI adoption an accountable structure before scale makes it ungovernable.
ES-08AI Security & Red Teaming
Test AI systems the way an adversary would, then prove the fix.
ES-09GRC Transformation
Replace duplicated spreadsheets with one control library and one evidence trail.
ES-10AI KYB / Risk Intelligence
Know who you are actually contracting with, and what changed since onboarding.
ES-11Tabletop & Executive Training
Rehearse the decisions, not just the technical steps.
ES-12Digital Trust Architecture
Make identity, cryptography, privacy and AI controls fit together as one system.