We take no compensation from any vendor
We take no commissions, no referral fees, no reseller margin, and no revenue share from any vendor, insurer, or provider. We do not sell, resell, deploy, or operate the tools we assess.
How we work
We work with you and your IT team to understand what the records support and agree clear next steps. Here is how we keep that review fair and independent.
Meet the thinking behind the firm.
Independence
What we sell is a judgment with no stake in the answer. Six commitments keep it that way.
We assess and design processes; we do not operate them
We review a process, refine it, and where asked help plan its implementation. We do not run the systems, tooling, or operations we assess, staff a security operations center, triage alerts, or hold production credentials. An assessor who also operates has an interest in the assessment's conclusion.
We do not assess work we did
Where we wrote a policy, designed a process, or supported an implementation, we do not later evaluate that work. Where a prior engagement overlaps a proposed assessment, we say so before the assessment is scoped.
Where a need exceeds our independence or our competence, we refer
Where the right answer is a specialist, for example in forensic acquisition, litigation support, penetration testing, or legal counsel, we name one and take no fee for the referral.
The findings are yours
The report, the scorecard, and the roadmap belong to you, whether or not any further work follows. Take them to your own team or providers. If you want our help afterward, that is separate work, agreed separately, and declining it changes nothing about what was delivered.
Client work is never published
We publish no case studies, no redacted reports, and no testimonials drawn from engagements. Client work is confidential and is never published.
Review and corrections
We invite your team and providers to add context, supply missing records, and correct factual errors before we finalize the report. We name the evidence cutoff, missing records, and any material disagreement. Insufficient evidence or a domain outside scope is reported as such; neither becomes a maturity score of zero.
The scale
Where the evidence supports a rating, a domain gets a status and a maturity score. The status (Defensible, At Risk, Critical Gap) is the finding. The maturity score, on our own 0 to 5 scale below, describes how the control is managed. The score is not a NIST certification or maturity tier. Findings carry a severity, and each severity has a remediation window. How we check the evidence shows six of the checks in full.
| Score | Label | What it means |
|---|---|---|
| 0 | Nonexistent | No control exists. The risk is unmanaged and unowned. |
| 1 | Initial | The control exists in an ad hoc, undocumented, person-dependent form. |
| 2 | Repeatable | The control is applied consistently but relies on informal habits, not a written process. |
| 3 | Defined | The control is documented, assigned an owner, and applied on a known schedule. |
| 4 | Managed | The control is measured. Someone reviews its effectiveness on a regular cadence. |
| 5 | Optimized | The control is measured, reviewed, and actively improved based on what the measurements show. |
| Severity | Remediation window |
|---|---|
| Critical | Within 30 days |
| High | 31-90 days |
| Medium | 91-180 days |
| Low | After 180 days |
The windows guide planning. An active threat or an exposed recovery path can need action the same day, and the finding says so.
See it applied to your business
Tell us what you need help understanding. We reply within two business days. Start with a free 30-minute scoping call, or discuss the scope by email if you prefer.
Talk with us