Half a day with your people, a week to write it up.
STEP 1 OF 3
Work out what actually applies to you
Before anyone tests anything, we establish which regime catches you, what you are actually exposed to, and what a defensible security programme looks like at your size. You get that in writing whether or not you hire us.
Consultancy
Most security spending goes wrong here rather than later. An organisation buys monitoring when its real exposure is a supplier with remote access, or commissions a penetration test to satisfy an obligation that a test does not satisfy. Half a day of asking the right questions changes what the next two years cost.
What happens
- Establish which of ZInfV-1, DORA and the CRA apply, and which do not
- Map what you already own — most estates have more capability switched off than on
- Identify the three things that would hurt most, in your business rather than in general
- Set a budget and an order of work you can take to a board
WHAT IT COSTS YOU IN TIME
WHAT YOU ARE LEFT HOLDING
A written scope note: which obligations apply, what your exposure is, what to do first, and what it will cost. Yours to keep.
When this is the right first move
- An obligation has landed and nobody can say for certain whether it applies to you
- The board has started asking questions the IT department cannot answer in board language
- You are about to spend money and want to know it is going at the right thing
- A customer questionnaire has arrived and half the questions do not map to anything you have
And when it is not. Skip it if you already have a current risk assessment somebody senior signed and can defend. That is the output; if it exists, start at the assessment instead.
The other steps
This is where most engagements start
The first step costs you half a day and ends in a document you keep whether or not you go further.