How we work

Independence

What we sell is a judgment with no stake in the answer. Six commitments keep it that way.

We take no compensation from any vendor

We take no commissions, no referral fees, no reseller margin, and no revenue share from any vendor, insurer, or provider. We do not sell, resell, deploy, or operate the tools we assess.

We assess and design processes; we do not operate them

We review a process, refine it, and where asked help plan its implementation. We do not run the systems, tooling, or operations we assess, staff a security operations center, triage alerts, or hold production credentials. An assessor who also operates has an interest in the assessment's conclusion.

We do not assess work we did

Where we wrote a policy, designed a process, or supported an implementation, we do not later evaluate that work. Where a prior engagement overlaps a proposed assessment, we say so before the assessment is scoped.

Where a need exceeds our independence or our competence, we refer

Where the right answer is a specialist, for example in forensic acquisition, litigation support, penetration testing, or legal counsel, we name one and take no fee for the referral.

The findings are yours

The report, the scorecard, and the roadmap belong to you, whether or not any further work follows. Take them to your own team or providers. If you want our help afterward, that is separate work, agreed separately, and declining it changes nothing about what was delivered.

Client work is never published

We publish no case studies, no redacted reports, and no testimonials drawn from engagements. Illustrative material, such as the report page, says so in a visible header, not a footnote.

Credentials

Ask for our credentials in your first email. We send a mutual NDA and share them, with our professional background, before you agree to any scope or fee. We do not publish them, or personal identities, on this site.

Review and corrections

Before the report is final, the client and participating providers can correct factual errors or provide relevant records. We name the evidence cutoff, missing records, and any material disagreement. Insufficient evidence or a domain outside scope is reported as such; neither becomes a maturity score of zero.

The scale

Where the evidence supports a rating, a domain gets a status and a maturity score. The status (Defensible, At Risk, Critical Gap) is the finding. The maturity score, on our own 0 to 5 scale below, describes how the control is managed. The score is not a NIST certification or maturity tier. Findings carry a severity, and each severity has a remediation window. How we check the evidence shows six of the checks in full.

The windows guide planning. An active threat or an exposed recovery path can need action the same day, and the finding says so.