Compliance audits
Independent assessments against national and international standards, with findings you can act on and evidence an auditor will accept.
What you get
Readiness and gap assessment
We map your current controls to the standard and show what is missing, in priority order.
Formal audit
Control testing, evidence review and interviews, reported against each requirement.
Remediation roadmap
Owners, effort and sequence for closing each finding, written for executives and engineers.
Re-test and closure
We verify fixes and issue an updated report.
Standards we map to
How it runs
- Scope. Agree systems, standards and timelines in writing.
- Assess. Review controls, test them and collect evidence.
- Report. Deliver risk-ranked findings and a roadmap.
- Verify. Re-test and issue the closure report.
Questions
Do you audit systems you also built?
No. Where we audit an organisation, we do not also design or run its controls. We keep those teams separate and say so in the engagement terms.
Which standard should we start with?
Start with the one your regulator or largest customers require. PISF, ISO/IEC 27001 and NIST CSF share much of their evidence, so work done for one helps the others.
Can you work on our premises under NDA?
Yes. On-site work under NDA is standard for us, including in restricted and air-gapped networks.
How long does an audit take?
It depends on scope and size. We give a timeline after a short scoping call.