Cybersecurity verification
actually. examines the evidence behind your cybersecurity controls and reports findings to business leadership. We agree what to check, assess what the evidence supports and identify the questions that remain. Your IT team or provider continues to operate the systems and carry out changes.
Cybersecurity verification is an independent check of whether the security controls a business believes it has are actually present, correctly configured, monitored and governed. It is carried out by a firm that does not sell or manage those controls. Findings explain what the evidence supports within the agreed scope and period, and what remains unverified.
The distinction that matters
An invoice, an installation and a configuration each tell you something different. An audit examines what those records establish.
The tool appears on the invoice and in the provider's stack diagram. That is a purchase, not a protection.
The tool is installed, but coverage may be partial: the exceptions, the service accounts and the executives are often the gaps.
Settings describe how a control is intended to work. Changes, exceptions and actual use still need to be examined.
An independent examination establishes what the evidence supports, for a defined scope and period, and records what remains unverified.
What we verify
The agreed scope may cover the areas below. We examine their configuration, coverage, monitoring and governance, and report findings and limitations. These are controls we audit, not IT operations we take over.
A prioritized view of cybersecurity risk written for business leadership, not only for technical teams.
Cybersecurity is one part of a wider picture. More on technology as a concentrated business risk.
Evidence and its limits
These examples show how we frame a check. The engagement defines the actual systems, accounts, period and validation in scope.
How the audit works
Identify the business question, systems, period, criteria and access. Record any exclusions before the examination.
Review records, discuss the controls with the responsible people and carry out the agreed sampling or validation.
Explain what was examined, what the evidence supports, what remains uncertain and which actions leadership should prioritize.
Your team or provider implements changes. A follow-up engagement can examine the evidence that an identified finding has been addressed.
You receive a plain-language assessment with findings, business implications and prioritized recommendations. See an illustrative audit finding, including the evidence limits and follow-up question.
The questions we answer
We do not sell security tools and we take no vendor commissions, so we have no stake in the answer. That is what makes the answer worth having. More on what independence means here.
Choose the right examination
We examine controls and their supporting evidence within an agreed scope. Findings give leadership a basis for decisions and a discussion with the responsible provider.
Penetration testing is not included in a standard review. Where it is appropriate, we can help define the scope, coordinate a qualified independent specialist and interpret the findings.
A standard review does not issue a SOC 2 report or ISO certification. If a regulator, customer or contract requires a particular examination, establish that requirement before agreeing the engagement.
For insurance questions, we examine the evidence behind control statements. We do not determine coverage or claim outcomes. The cyber-insurance questionnaire guide explains where to start.
Before the engagement
Start with the decision leadership needs to make. We agree what the audit will examine before the work begins.
We agree access before the engagement begins. The starting point may be interviews, reports, contracts and documentation. Verification may also require read-only or supervised access to selected systems and configurations. The scope identifies what we can examine and what remains outside the review.
The fee is quoted before work begins. It depends on the agreed scope, the size and complexity of the environment, and the evidence and validation required. Tell us the question you need answered so we can explain what the work would involve.
Timing depends on scope, the availability of evidence and the interviews or validation required. We discuss those requirements when scoping the engagement. A focused control review and a review of the wider technology environment require different amounts of work.
Your provider or internal team continues to operate your systems and carry out changes. actually. examines the evidence, reports findings and can verify remediation. An audit can inform a decision to retain or change a provider; we do not take over IT delivery.
Read more about what determines an independent IT audit's cost, or discuss the question you need examined.
How it is delivered
Cybersecurity verification is one of the areas covered by the flagship independent assessment.
Through the yearControls are re-verified on a recurring cadence, because a control that was correct last quarter may not be correct now.
On its ownFor businesses that need to answer one question: is the security we are paying for actually working?
Before commissioning anything, you can ask for the evidence yourself. Ten questions to ask your IT provider is a free checklist covering backups, access, patching and alerting, with evidence to request and questions to follow up.
An independent verification of the controls your business depends on, reported in language leadership can act on.
Keep reading
How to connect each technical answer to supporting records and resolve uncertainty before submission.
Technology riskThe risks that sit with the owner whoever holds the contract, and how each one is checked.
ServicesThree ways to work with an independent firm, from one report to a standing seat at the table.