Answer the questionnaire with evidence.
A risk register, controls mapping, policy gap analysis and an audit-readiness roadmap — so the next client security review, insurance renewal or framework deadline is a document you send, not a scramble.
Apply for an engagement Book a scoping callScoped per engagement. We confirm fit before taking payment — there is no checkout button on this page for a reason.
When this is the right engagement
A client is asking
An enterprise customer has sent a security questionnaire and the honest answers are currently “we think so”.
Insurance is tightening
Your cyber renewal now demands controls you have not documented, and the premium depends on the answer.
A framework is coming
SOC 2, ISO 27001, HIPAA or CMMC is on the horizon and you need to know the real distance before committing to an auditor.
Nobody owns risk
Risk lives in three inboxes and one spreadsheet. You need a register with owners, dates and a review cadence.
What we deliver
- Risk register — identified, rated and owned, in a format you can maintain after we leave
- Controls mapping — your existing controls mapped to your target framework, showing what already counts
- Policy gap analysis — which policies exist, which are stale, which are missing, and which are fiction
- Evidence inventory — what you can already prove today and where the evidence lives
- Audit-readiness roadmap — sequenced remediation with effort estimates and a realistic date
- Questionnaire response pack — defensible answers to the questions clients and insurers actually ask
Final scope depends on framework, headcount and system count. Ongoing evidence collection and control monitoring can continue as a retainer.
Apply for an engagementQuestions we get
Do you certify us?
No, and neither does anyone who tells you they do. Certification comes from an accredited auditor. We get you to the point where that audit is worth booking.
How long does it take?
Typically four to eight weeks to a complete readiness picture, depending on framework and how much documentation already exists.
Is this worth it if we are small?
If a client questionnaire is blocking a deal, yes. If nothing is forcing the issue, the $997 IT Health & Risk Assessment is the cheaper place to start.
Why is there no buy button?
Because the scope genuinely varies and we would rather turn away a bad fit than sell you the wrong engagement.
Get the readiness picture first
A scoping call tells you whether this engagement is the right size for where you are.
Apply for an engagement Start with the $997 assessment