Services / Assessment
A review of what is in place and what is still missing.
We read your policies, talk to the people who run your systems, and test the controls directly through configuration exports, access lists, device status, and logs. You get a written report, with findings ranked by audit impact, and a fixed price to close the gaps. Two to four weeks, from $7,500.
What we compare3 sources · 1 report
PoliciesWhat your documents and questionnaires say
InterviewsWhat your team describes
SystemsWhat configuration and logs show
FindingsWhere they differ, ranked by audit impact
covers every system in scope
Scope
What we check.
Identity & access
SSO · MFA · reviews
Devices & endpoints
MDM · encryption · EDR
Cloud configuration
AWS · GCP · Azure
Change & code
Reviews · CI · deploys
Logging & monitoring
Coverage · alerting
Vendors & data
Subprocessors · retention
Schedule
Two to four weeks from kickoff.
Week 1
Kickoff, system inventory, read-only access to the systems in scope, and interviews with the people who run them.
Weeks 1–3
We test each control against system data on every system in scope.
Weeks 3–4
We rank the findings by audit impact and risk, then give you a realistic timeline to being audit-ready.
After
We walk your team through the findings and send a fixed-price Build proposal. You can use the report with us or on your own.
What you get
Three documents you keep.
Gap report
Every finding with what we observed, why it matters to the audit, and what fixing it involves. Written for engineers and executives.
Asset and system inventory
What is in scope: systems, data stores, vendors, and who has admin access to each.
Fixed-price plan
The work to become audit-ready, sequenced and priced, with a realistic date you can give a customer.