OUR APPROACH

From a business concern
to an agreed plan.

The engagement starts with understanding your organization. The work and the level of continuing support are then shaped around what you need to achieve.

01 / THE ENGAGEMENT

Initial conversation

Describe your organization, the concern that brought you here, and what you need to accomplish. Discuss current capabilities and constraints, including deadlines and existing providers. You do not need a polished requirements document to begin.

02 / THE ENGAGEMENT

Evaluate the current situation

Review relevant business processes, technologies, and security practices. The purpose is to understand the starting point and identify potential weak points or areas for improvement before defining the work.

03 / THE ENGAGEMENT

Agree the project scope

Translate the initial evaluation into a plan. Clarify the goals, boundaries, responsibilities, and intended outputs. Agree which work is included and how the organization will participate so expectations are clear.

04 / THE ENGAGEMENT

Carry out the assessment or agreed work

Examine the relevant systems, processes, and risks within the defined scope. The methods depend on the service: a technical vulnerability assessment involves different work from policy development or a vendor response review.

05 / THE ENGAGEMENT

Organize and track improvement

Use the findings to guide priorities and next actions. Program management can provide structure for maintaining the program and tracking progress. Implementation responsibilities should remain explicit rather than assumed.

06 / THE ENGAGEMENT

Review progress and changing needs

Meet to discuss progress and new circumstances as agreed. Revisit priorities when business systems, requirements, or risks change. Continuing support should have a clear purpose and cadence that fits the organization.

SET THE EXPECTATIONS EARLY

Five questions worth resolving
before the work begins.

What is in scope?

Name the systems, business activities, requirements, or vendor relationships included. Make any boundaries or exclusions understandable.

Who needs to participate?

Identify the people who can authorize access, explain existing practices, approve decisions, and carry out changes.

What will the work produce?

Agree the findings, documents, recommendations, or guidance expected. Be clear about any implementation or verification work.

How will progress be reviewed?

Discuss communication, decision points, and how questions or changes will be handled during the engagement.

What happens after the initial work?

Determine whether the organization needs a handoff, follow-up review, program management, or continuing leadership support.

From a business concernto an agreed plan.