Gap assessment report
Current position against the standard, with every finding ranked by assessment risk.
Compliance & Audit
Audit readiness is a by-product of doing the work properly, not a project you run the month before an assessor arrives. We build the evidence trail as the controls go in.
Evidence, not assumptions
Compliance & Audit
Most organisations do not fail an assessment because their security is bad. They fail because nobody can produce evidence that it works. We close that gap by treating evidence as a delivery artefact rather than paperwork generated in a panic afterwards.
- Engagement type
- Project, with optional retainer
- Typical duration
- 6 to 12 weeks
- Primary output
- Evidence pack and remediation plan
- Best suited to
- A first assessment, or a failed one
How it runs
Five Phases, End to End
01
Gap assessment
We test your current position against the standard you actually answer to, and rank what is missing by how likely it is to stop you passing.
02
Control implementation
Missing controls are put in place in order of assessment risk, with the evidence captured at the moment each one goes live.
03
Documentation
Policies and procedures written so the people who have to follow them can actually follow them — not copied from a template.
04
Internal audit
A dry run against the real criteria, so the first time anyone tests you it is us, not the assessor.
05
Handover
You keep the evidence pack, the register and the runbooks. Nothing about your compliance position depends on us still being here.
What you receive
Everything That Lands On Your Desk
Named artefacts, not a verbal summary. You keep all of it whether or not you engage us again.
Evidence pack
Screenshots, configs, logs and sign-offs, indexed against each control.
Policy set
Policies and procedures written for your organisation, not a generic template.
Remediation plan
Owners, dates and status for every open item, maintained through to closure.
Ready to Book Compliance & Audit?
Tell us the shape of your estate and we will come back with scope, sequence and a fixed price.