What the engagement produces
Deliverables you can hand to an auditor, a regulator or a board committee without rewriting them first.
Asset and process inventory
What you own, what it supports and who depends on it, which is the part most registers quietly skip.
Threat and vulnerability mapping
Credible threats per asset class, cross-checked against technical findings rather than assumed from a catalogue.
Likelihood and impact scoring
A scoring model agreed with you, applied consistently, with the reasoning recorded next to each score.
Risk register
Every risk with an owner, a rating, existing controls and a decision: treat, transfer, tolerate or terminate.
Control gap analysis
Current controls compared against ISO 27001, PCI DSS, PDPL or your regulator, with the gap stated plainly.
Treatment plan
Prioritised remediation with effort, dependency and cost, sequenced so the first quarter is achievable.
Third-party risk review
Supplier access, contractual controls and evidence quality assessed for the vendors that matter.
Board-level reporting
A short report that says what the exposure is, what it would cost and what you propose to do about it.
Reassessment cycle
A defined cadence and a lighter repeat process, so the register is current instead of historical.
From an unmeasured estate to a funded treatment plan
The register is not the deliverable. The decisions it forces are.
One-off assessment
A defined engagement with a fixed scope and deliverables: risk register, gap analysis, treatment plan and board report.
Ongoing programme
A vCISO arrangement where we own the register, run the reassessment cycle and report to your board each quarter.
Work that usually follows
ISO 27001
The register and treatment plan are the backbone of a certifiable management system.
Vulnerability management
Technical exposure needs a running process, not an annual snapshot.
Penetration testing
Testing validates whether the controls you rated as effective actually are.