Cyber Security
The control plane above the technology: what the organisation has decided to protect, how much risk it will carry, and how it evidences that to auditors, insurers, regulators and customers in every market it operates in. Framework-led rather than jurisdiction-led - one control set, mapped outward to whichever regime asks.
What we deliver
Every engagement is scoped to your environment - deploy a single capability or the full stack.
A costed multi-year security plan anchored to business risk, with an operating model that says who runs each control.
One internal control library, scored for maturity and cross-mapped so a single piece of evidence satisfies several frameworks at once.
A risk register the business will argue with - scenarios, named owners, and treatment decisions that are actually made.
Security risk expressed as a loss distribution in currency, so it competes on the same terms as every other capital request.
A document hierarchy engineers can follow and an assessor will accept, versioned like code rather than kept in a shared drive.
A management system that survives surveillance audits without a fire drill each cycle.
Evidence produced as a by-product of running the controls, not assembled in the fortnight before fieldwork.
One control set that answers every regime the business trades under, with the deltas isolated rather than duplicated.
Privacy obligations designed into systems and pipelines rather than retrofitted at assessment time.
A vendor assurance programme that scales past a questionnaire spreadsheet and tracks obligations after signature.
Recovery objectives that have been measured under adversarial conditions rather than asserted in a plan.
Behaviour measured in report rates and dwell time, not in training-completion percentages.
Senior security ownership on a fraction of a head, accountable inside your governance forums.
Technical deep dive
Applies to any multi-entity group carrying several attestations at once - a management-system certification, a service-organisation report, a payment-card assessment and one or more privacy regimes.
What this is
A control assurance pipeline. Every control in a single internal library is bound to a machine-readable test and a system of record that can prove it. Tests run on a schedule, results are stored immutably, and the framework-specific views are generated from that one store rather than assembled by hand for each auditor.
The problem being solved
The group holds four attestations across three regions. Each has its own control list, its own evidence request, its own sampling window and its own auditor. Roughly seventy per cent of the underlying controls are the same control described in four different vocabularies - and each one is evidenced four times, manually, by the same three engineers. Fieldwork consumes six weeks per cycle, the evidence is a point-in-time screenshot with no assurance about the days either side, and a control that silently fails in month four is only discovered in month eleven.
Why it is hard
Reference architecture - step through it
control:
id: GG-AC-014
statement: >
Privileged access to production is time-bound; no standing
administrative role assignment persists beyond 8 hours.
owner: platform-security
systems_of_record: [identity_provider, cloud_org_a, cloud_org_b]
test:
schedule: "*/30 * * * *" # every 30 minutes
assert: |
count(
role_assignments
where scope startswith "/prod"
and type == "permanent"
and role in PRIVILEGED_ROLES
) == 0
on_fail:
severity: high
route: platform-security@queue
evidence: [assignment_id, principal, role, created_at]
mappings: # one control, four vocabularies
- {framework: iso_27001_2022, clause: "A.5.18", coverage: full}
- {framework: soc2, criteria: "CC6.1", coverage: partial,
note: "paired with GG-AC-015 for periodic review"}
- {framework: pci_dss_4, req: "7.2.2", coverage: full}
- {framework: nist_csf_2, subcat: "PR.AA-05", coverage: full}Measured change
| Measure | Before | After |
|---|---|---|
| Evidence cycle per attestation | 6 weeks of engineer time | 2 days of review |
| Control verdicts per year | 1 point-in-time sample | 17,520 continuous assertions |
| Mean time to detect control failure | up to 11 months | under 1 hour |
| Controls evidenced more than once | 70% duplicated 4× | 0% - single library, four views |
The control set barely changed. What changed is that it now proves itself continuously, in a vocabulary each auditor recognises, without four teams doing the same work four times.
Schedule a free consultation and our team will connect within 12 hours to understand your environment and map out the right approach.
We respond within 12 hours