Project Assess & assure
Security assessments and consulting
If you can't say which controls you have, which you lack and which matter most, you can't plan or budget. We find the gaps in two weeks and give you a 90-day roadmap.
- Gap analysis
- 2 weeksfrom kick-off to findings
- Roadmap
- 90 daysprioritised actions, in order
- Frameworks
- CE · ISO · CAFfindings mapped to the standard you need
- Leadership
- vCISOsenior advice without a full-time hire
01 / The problem
You know security matters. You don't know where to start.
No clear baseline
Tools have been bought over the years, but nobody has checked what they cover together. The gaps sit between them.
Advice that ignores your budget
Generic checklists give you fifty actions with equal weight. You need to know which five to do first.
Nobody owns it
Security lands on the IT manager or the finance director, on top of the day job. Decisions stall.
02 / What’s included
From first look to a plan you can act on.
Gap analysis
Two weeks reviewing your people, processes and technology against the controls that matter for your size and sector.
Posture review
A deeper look at one area, such as identity, cloud or remote access. Findings ranked by risk.
90-day roadmap
Prioritised actions with owners and the order to do them in. Built around your budget, not a wishlist.
Virtual CISO
A named senior adviser, part time. Board reporting, programme oversight and someone to call when a decision comes up.
Policy and process
We write or update the policies you need: acceptable use, access control, incident response, supplier security. Written to be followed, not filed.
Certification routes
If the roadmap points to Cyber Essentials, ISO 27001 or the CAF, our compliance team picks it up. Links to those pages.
[Placeholder: offer for this service, written by ITB]
03 / How it works
Two weeks to a clear picture.
- Scope We agree what's in scope, who we need to talk to and which framework to measure against.
- Assess Interviews, configuration reviews and document checks across people, process and technology.
- Report Findings ranked by risk, in plain English, with the evidence behind each one.
- Roadmap A 90-day plan, walked through with your leadership, ready to fund and start.
A report you can't act on is just a longer list of worries. We'd rather give you five things to do on Monday.
How ITB runs assessments
04 / Why ITB
Advice from people who run the controls.
We run SOC, EDR and firewall services for clients every day. Our advice comes from what works in practice, and we can deliver the fixes if you want us to.
- Practitioners, not theorists: the people assessing you also operate security services.
- Plain English: a report your board can read, with the technical detail in an appendix.
- Budget-aware: every recommendation comes with a reason and a rough order of cost.
- Your choice what happens next: take the roadmap and do it yourself, or have us assess, fix, certify and run.
· 05 / Questions
Security assessments, plainly answered.
Q01 What's the difference between a gap analysis and a pentest?
A gap analysis looks at your whole security programme: people, policies, processes and technology. A pentest tries to break into specific systems to show what an attacker could reach. They answer different questions, and many clients do both.
Q02 Which framework do you assess against?
The one that fits you. For most UK SMEs that's the Cyber Essentials controls plus a few extras for your sector. If you need ISO 27001, the NCSC CAF (Cyber Assessment Framework) or NIST CSF (Cybersecurity Framework), we map findings to that instead.
Q03 How much of our time does it take?
Mostly a few interviews, plus access to configuration and documents. We agree the schedule at scoping so it fits around your team.
Q04 Is an assessment the same as getting certified?
No. An assessment tells you where you stand. Certification is a formal process with an external body. If you need a certificate, see Cyber Essentials & IASME or Compliance: ISO 27001 & CAF.
Q05 What is a virtual CISO?
A CISO (chief information security officer) owns security strategy and reports to the board. A virtual CISO does that job part time, for organisations that need the judgement but not a full-time hire.
Related services
Cyber Essentials & IASME
The certificate most roadmaps start with.
See the serviceCompliance: ISO 27001 & CAF
When the roadmap needs a formal standard behind it.
See the servicePentesting
Technical proof to sit alongside the assessment.
See the serviceUser Awareness & Phishing
The people gaps an assessment usually finds.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]