GRC · Specialist service
Organisational and technical audit and maturity assessment
A list of deployed tools does not show how effectively an organisation manages security. We combine process assessment with technical verification to identify the most valuable improvements.
Service scope
Cybersecurity audit
The audit covers an agreed cross-section of the organisation: roles, system management, configuration and control operation. We use documentation, interviews and technical data samples. Each finding is linked to evidence, impact and a recommended action. Maturity assessment allows process practices to be compared, while priorities reflect service importance, identified exposure and potential consequences. The report clearly states access limitations and the sampling scope.
Security organisation
We examine roles, decision-making principles, documentation and team coordination. We verify how exceptions and overdue corrective actions are managed.
Access and configuration
We analyse agreed samples of permissions, system settings and network segmentation. We compare the actual state with adopted principles and business needs.
Response and resilience
We review incident handling, monitoring, backups and recovery test evidence. We check whether procedures have owners and evidence of execution.
Maturity and improvement plan
We apply agreed process assessment criteria. We distinguish missing controls from missing evidence and identify areas needing further investigation.
Project deliverables
What will your team receive?
- Audit report with evidence and assessment limitations.
- Maturity map of the agreed areas.
- Register of findings and related risks.
- Prioritised improvement plan with assigned responsibilities.
Delivery conditions
What do we agree before starting?
- Agreed scope, criteria and assessment authorisation.
- Access to documentation, configurations and representative evidence.
- Participation of the process owners and administrators being assessed.
How we work
From understanding the need to verifying the result.
Define the criteria
We define areas, methods, samples and access rules, and establish what constitutes sufficient evidence.
Verify the current state
We conduct interviews, document analysis and agreed technical checks. We confirm facts with area owners.
Organise the actions
We discuss findings with management and provide priorities, dependencies and criteria for closing recommendations.
Clear responsibilities
What is already included, and what do we extend?
An organisational audit is a GRC extension. Selected configuration reviews and Enterprise operational audit support concern the service scope, rather than a comprehensive assessment of the client’s maturity.
Before making a decision
Questions about cybersecurity audits
Does the audit include a penetration test?
Not automatically. Controlled attempts to exploit vulnerabilities require a separate scope, testing rules and authorisation. Existing penetration test results may be used as audit evidence.
Does the audit concern only the IT department?
No. It covers agreed processes and their owners, such as access, supplier and incident management. Technology is one part of the assessment.
Does a positive result confirm there are no vulnerabilities?
No. The assessment relates to a particular point in time, scope and available evidence. The report also identifies unverified areas and the need for further investigation.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.