Frameworks we audit against
We work with the framework your business is measured on — and translate between them where you are answering to more than one.
- CIS Critical Security Controls v8 — implementation group scoping and maturity scoring.
- CIS Benchmarks — configuration audits for Windows, Linux, cloud, databases, Kubernetes and network devices.
- NIST Cybersecurity Framework — Identify, Protect, Detect, Respond, Recover maturity assessment.
- NIST SP 800-53 and SP 800-171 control mapping for regulated and supply-chain requirements.
- ISO/IEC 27001 readiness reviews ahead of certification or surveillance audits.
- Sector requirements including data protection obligations and central bank IT risk guidelines.
How the audit runs
Audits are evidence-based, not questionnaire-based. We look at live configuration and real artefacts, because self-assessment spreadsheets are exactly where certification failures hide.
- Scoping workshop to agree systems, business units, framework and implementation group.
- Document and policy review — governance, standards, procedures and prior audit findings.
- Technical configuration review against benchmark baselines using automated and manual checks.
- Interviews with control owners to test whether documented process matches daily practice.
- Sample-based evidence collection: access reviews, change records, backup restores, incident tickets.
- Scored gap report with control-by-control status, root causes and effort-rated remediation actions.
Deliverables you can take to the board
Everything is written so two audiences can use it: the executive who needs the risk position in one page, and the engineer who needs the exact setting to change.
- Maturity scorecard with a clear current-state baseline and target-state gap.
- Prioritised remediation roadmap phased over 30, 90 and 180 days.
- Control-owner matrix so every gap has a name against it.
- Evidence pack aligned to auditor expectations for the chosen framework.
- Follow-up verification audit to confirm and document closure.
Why it matters commercially
Compliance work is no longer only a regulatory cost. Enterprise procurement, cyber insurance underwriting and partner due-diligence questionnaires all now demand evidence of tested controls. Organisations that can answer quickly win contracts faster and pay lower premiums; organisations that cannot are asked to fix everything at the worst possible moment, under deadline.
Frequently asked questions
Is this the same as certification?
No — we are an independent assessor, not a certification body. Our audits prepare you to pass certification and give you the evidence trail auditors ask for.
How long does an audit take?
A focused CIS Controls or NIST CSF assessment for a mid-sized environment typically takes 2–4 weeks including reporting. Multi-entity or ISO 27001 readiness work is scoped individually.
Can you also fix the gaps you find?
Yes. Many clients pair the audit with our architecture and vulnerability management services so remediation starts immediately rather than waiting for the next budget cycle.
