Six steps, in this order, the same for every client. The last one is optional, the rest are not.
A short conversation to establish what's actually at stake, the regulatory context, and whether this engagement is the right fit, before anything is scoped or quoted.
Structured interviews spanning blue-collar and white-collar staff, management, and C-level where possible. Real exposure lives in how people actually work, not only in what policy documents say.
Mapping the gap between documented controls and actual technical and organisational reality, informed by the interviews and direct technical review.
Findings ranked by real business impact, not a flat checklist: what needs fixing first, what can wait, and why.
Hands-on support closing the gaps identified, working alongside internal teams rather than handing over a document and leaving.
Optional. For clients who need ongoing assurance rather than a point-in-time engagement, a fractional or advisory arrangement keeps the posture current as the organisation changes.