Assessment
A fixed-fee written report on who generates, stores and can use each key that protects your data. It covers 48 questions in eight areas, each backed by evidence you supply.
How it works
From question to proof
An assessment first. Then, if you choose, the work to fix what it finds and keep it fixed.
Three steps
Implementation
Most reports point to one action first: move the master key for your most sensitive data into certified hardware you control. A first wave connects up to eight systems, so the provider must call a service you control before it can decrypt.
Managed key custody
Your keys stay in a dedicated hardware module hosted in the UK, from a vendor and host checked for any US parent. Each month you receive a report of every operation requested on your keys.
21 working days, start to finish
Your part is one senior sponsor, one architect and a folder of documents you already hold. The stages overlap, so a delay in one does not stop the others.
-
Day 0 Scoping call We confirm data, systems and providers.
-
Days 1 to 5 Questionnaire You answer 48 questions in your own words.
-
Days 3 to 10 Evidence review You send exports with secrets removed.
-
Days 8 to 12 Interview A 90-minute session with your architect.
-
Days 12 to 15 Scoring A second consultant checks every score.
-
Days 17 to 21 Report and read-out We walk through it in 60 minutes.
What you get
A written report that is yours to use with any supplier. It contains no sales material.
- Board-ready summaryOne page for your board or risk committee.
- Score and ratingA score from 0 to 100 and a rating from Low to High.
- FindingsEach with its evidence, severity, owner and fix.
- 30/90/180-day roadmapActions ranked by the exposure each removes per pound spent.
I never take your secrets or receive a key.