GRC program design
We stand up or mature your governance, risk and compliance program: roles, risk register, control library and reporting to leadership.
Deliverables- Maturity assessment
- Risk register
- GRC roadmap
Practice / CYB
Governance, risk and compliance that stands up to scrutiny.
We design and run security programs that protect sensitive data, satisfy regulators and customers, and give leadership a clear view of risk. Our focus is governance, risk and compliance (GRC), including the third parties you rely on.
What we do
Security programs built to pass audits and reduce real risk
Frameworks and audits are only useful if they reflect how your organization actually works. We map controls to your operations, close the gaps that matter most, and leave you with evidence you can show an auditor or a customer.
Third-party risk management
We build a TPRM program that inventories vendors, tiers them by risk, runs due diligence and monitors them over time.
Deliverables- Vendor inventory
- Risk tiering
- Due diligence reviews
Security risk assessments
We identify threats to your systems and data, rate likelihood and impact, and recommend treatments in priority order.
Deliverables- Risk assessment report
- Treatment plan
Policies and controls
We write the policies, standards and procedures auditors expect, mapped to the frameworks you need to meet.
Deliverables- Policy set
- Control mapping
- Procedures
Audit readiness
We run gap assessments and readiness reviews ahead of SOC 2, ISO 27001 or HIPAA audits, and help collect evidence.
Deliverables- Gap assessment
- Evidence tracker
- Remediation plan
Medical device security
With our Biomedical practice, we inventory connected clinical devices, assess their risk and segment them safely from the wider network.
Deliverables- Device inventory
- Risk ratings
- Segmentation plan
Frameworks
Frameworks we work with
We align programs to the framework your regulators, customers or board expect, and map overlapping controls so you only do the work once.
| Framework | Where it applies |
|---|---|
| NIST CSF 2.0 | Overall cybersecurity program structure and maturity |
| NIST SP 800-53 | Detailed security and privacy control catalog |
| ISO/IEC 27001:2022 | Certifiable information security management system |
| SOC 2 | Trust Services Criteria for service organizations |
| HIPAA Security Rule | Safeguards for electronic protected health information |
| PCI DSS | Security of payment card data |
Clients
Who we work with
Engagements are scoped to the organization. A first conversation is free and carries no commitment.
Healthcare organizationsProviders protecting patient data and connected devices.
Growing companiesTeams facing their first SOC 2 or ISO 27001 audit.
Vendors and SaaS providersBusinesses answering customer security questionnaires.
Regulated businessesOrganizations that need ongoing compliance support.
Insight
From our Cybersecurity practice
Practical guidance from the team.
Why third-party risk is now a board-level issue
Many of the largest breaches start with a supplier. Boards are asking how vendor risk is identified, measured and controlled.
Read article →