Home / Security Testing & Assurance

Security Testing & Assurance

Cyber Risk Assessment

Connect critical assets, threats and existing controls to business impact and a practical risk treatment roadmap.

Start your enquiry

SERVICE IN DETAIL

From the first assessment to practical outcomes

Who this service is for

Organisations building a management framework, preparing for customer requirements or improving an existing programme.

How we work

  1. Assessment & gap analysis

    Business services, information assets, threat scenarios and existing safeguards

    Interview process owners, examine the current documents and sample supporting records. Identify gaps against the agreed framework and distinguish missing controls from controls that lack operating evidence.

  2. Implementation roadmap

    Likelihood, business impact, risk ownership and treatment alternatives

    Prioritise actions by business risk and dependencies. Work with your owners on policies, procedures, responsibilities and practical evidence templates, then support adoption through agreed working sessions.

  3. Readiness & improvement review

    Risk register, prioritised treatment and residual-risk decisions

    Review implementation evidence, discuss open issues and confirm ownership of remaining actions. Where formal certification or external assessment is needed, prepare the organisation for the appropriate independent assessment process.

What you receive

  • Gap assessment and prioritised action register
  • Agreed policies, working templates and implementation roadmap
  • Readiness summary and remaining actions for management

Before we begin

We confirm the scope, responsibilities, evidence, timetable and deliverables in the proposal. The activities above are tailored to the systems and objectives agreed with your organisation.

Discuss your scope

Specialist services

Security Baseline & Configuration Review

Review security configurations against agreed baselines and recommend practical hardening priorities.

View scope, process and deliverables

Who this service is for

IT and development teams preparing a release, validating security improvements or checking business-critical systems.

How we work

  1. Scope & rules of engagement

    Operating systems, databases, network devices and selected hardening criteria

    Agree the targets, access levels, test window, business constraints and stop conditions. Confirm written authorisation and prepare the accounts, network access or test data needed for the selected assessment.

  2. Testing & validation

    Configuration settings, privileged access, logging and unnecessary services

    Combine relevant tools with analyst review for the agreed test objectives. Validate findings, capture reproducible evidence and distinguish confirmed issues from results that need additional information or investigation.

  3. Remediation & retest

    Baseline deviations, change recommendations and agreed configuration rechecks

    Explain business impact, affected components and actionable fixes in a technical report and management summary. Where agreed, retest corrected issues and record their status without treating untested systems as covered.

What you receive

  • Agreed scope and test plan
  • Technical findings with evidence and remediation priorities
  • Executive summary and agreed retest record
Discuss this service

dSURE Cybersecurity Assessment

Assess digital products against the cybersecurity criteria within ALPHASEC’s dSURE assessment scope.

View scope, process and deliverables

Who this service is for

Boards, management, internal audit and regulated organisations that need an evidence-based view of controls.

How we work

  1. Scope & audit planning

    Digital product scope, product version and applicable dSURE assessment criteria

    Confirm the business activities, systems, locations and assessment criteria. Establish the audit period, evidence request list and sampling approach, taking account of the independence required for the engagement.

  2. Evidence-based assessment

    Product security controls, technical evidence and agreed assessment activities

    Interview control owners and trace selected transactions or activities to supporting records. Evaluate both control design and operation, validate exceptions with the responsible teams and document the basis for findings.

  3. Reporting & follow-up

    Assessment findings, corrective evidence and records for the dSURE process

    Present findings with risk, evidence and practical recommendations. Agree management responses, owners and target dates; review corrective evidence where follow-up is included. Any formal assurance conclusion depends on the applicable criteria and assessment results.

What you receive

  • Audit plan and evidence request list
  • Findings report with evidence, risk and recommendations
  • Management action register and agreed follow-up results

Relevant frameworks and guidance

Discuss this service

Outsourced Chief Information Security Officer

Support security leadership, governance and risk priorities through an agreed outsourced Chief Information Security Officer engagement.

View scope, process and deliverables

Who this service is for

Organisations building a management framework, preparing for customer requirements or improving an existing programme.

How we work

  1. Assessment & gap analysis

    Security leadership mandate, risk appetite, governance and current initiatives

    Interview process owners, examine the current documents and sample supporting records. Identify gaps against the agreed framework and distinguish missing controls from controls that lack operating evidence.

  2. Implementation roadmap

    Security roadmap, risk treatment, investment priorities and stakeholder decisions

    Prioritise actions by business risk and dependencies. Work with your owners on policies, procedures, responsibilities and practical evidence templates, then support adoption through agreed working sessions.

  3. Readiness & improvement review

    Management reporting, decision records and an owned improvement portfolio

    Review implementation evidence, discuss open issues and confirm ownership of remaining actions. Where formal certification or external assessment is needed, prepare the organisation for the appropriate independent assessment process.

What you receive

  • Gap assessment and prioritised action register
  • Agreed policies, working templates and implementation roadmap
  • Readiness summary and remaining actions for management
Discuss this service

Third-Party Risk & Supplier Assurance

Assess IT supplier risks and prepare control evidence and security questionnaires, including SIG Lite engagements.

  • IT Third-Party Risk
  • Supplier Assessment
  • SIG Lite
View scope, process and deliverables

Who this service is for

Organisations building a management framework, preparing for customer requirements or improving an existing programme.

How we work

  1. Assessment & gap analysis

    Supplier inventory, service criticality, data access and assessment tiers

    Interview process owners, examine the current documents and sample supporting records. Identify gaps against the agreed framework and distinguish missing controls from controls that lack operating evidence.

  2. Implementation roadmap

    Questionnaires, evidence validation, contractual safeguards and dependency risks

    Prioritise actions by business risk and dependencies. Work with your owners on policies, procedures, responsibilities and practical evidence templates, then support adoption through agreed working sessions.

  3. Readiness & improvement review

    Supplier risk profiles, corrective actions and reassessment priorities

    Review implementation evidence, discuss open issues and confirm ownership of remaining actions. Where formal certification or external assessment is needed, prepare the organisation for the appropriate independent assessment process.

What you receive

  • Gap assessment and prioritised action register
  • Agreed policies, working templates and implementation roadmap
  • Readiness summary and remaining actions for management
Discuss this service
LET’S UNDERSTAND YOUR NEEDS

Tell us what
you need.

Answer the service-specific questions, review your summary, and send your request to our team.

A high-level summary is enough. Please do not include passwords, payment card data or confidential system evidence.

Read our privacy notice

For urgent matters, call 091 003 4852

Discuss your requirements directly with our team.

Contact our team

Related services

Security Testing & Assurance

IT Audit & Control Review

Review IT controls using evidence to support governance, oversight and practical improvement.

↗
Security Testing & Assurance

Cloud Security & CSA STAR Readiness

Prepare cloud services for a structured security review with clear responsibilities, control evidence and a remediation plan.

↗