01 / Assessment
Cybersecurity and control assessments
Review selected risks, controls and supporting evidence. Receive documented findings and a prioritized action plan.
Cybersecurity and technology risk advisory for organizations
Understand your exposure.Strengthen the controls that matter.
We help organizations assess cybersecurity risk, prepare for customer assurance, clarify provider responsibilities and turn control evidence into practical priorities. Support is shaped around your sector, operating environment and the decisions ahead.
Your organization's control environment
Confidence starts with evidence.
You have policies, systems and service providers. Can you demonstrate how important controls work when it matters?
- Can you show who reviewed access and how exceptions were resolved?
- Do you know what your critical providers are responsible for, and what evidence they can provide?
- Would your team know who makes each decision during a disruption or security incident?
We examine these questions through a defined review, then document findings and practical actions for leadership, control owners and technology providers.
Our expertise
Support where your firm needs it.
02 / Readiness
Policies and incident readiness
Align procedures with how your firm operates. Clarify responsibilities and rehearse decisions through a facilitated tabletop exercise.
03 / Control testing
Control testing and remediation
Test agreed controls, investigate exceptions and review corrective actions. Targeted technical remediation can be scoped separately.
04 / Advisory
Ongoing technology risk advisory
Maintain an agreed schedule of reviews, decisions and follow-up as your firm and its technology change.
05 / Assurance readiness
SOC 2 & ISO/IEC 27001 readiness
Prepare for customer security reviews and independent assurance with a scoped gap assessment, control and evidence mapping, and a practical remediation roadmap.
Explore readiness support06 / Transactions
M&A Cyber & Regulatory Due Diligence
Cyber due diligence for buyers and readiness support for sellers. Identify security-related technical debt, assess remediation priorities and prepare evidence for transaction decisions.
Explore M&A due diligenceFor RIAs / Regulation S-P
Move from written policies to operational readiness.
For independent registered investment advisers (RIAs), we identify implementation gaps, clarify incident responsibilities and document how selected controls operate. We work alongside your Chief Compliance Officer (CCO) and legal counsel to turn findings into a prioritized plan.
- Control gaps
- Incident responsibilities
- Supporting evidence
Who we support
A specialized firm.
EXTRIMPA supports financial services, healthcare, technology, business services and retail organizations with focused technology risk and cybersecurity advisory. Our established specialization is independent RIAs, with additional readiness, assessment and transaction support shaped to each organization’s needs. Angel leads each engagement and works directly with your team to turn evidence into clear business decisions.
Direct technical leadership
Angel MontillaFounder & Managing Director
CISMCRISCISO/IEC 27001 Lead Auditor
Work directly with the person leading your review.
His background includes Big Four experience at KPMG and risk and control work at BNY, including BNY Pershing. He leads the scope and delivery of EXTRIMPA engagements, from the first conversation through the findings and follow-up.
Our manifesto
The discipline behind our work.
Claritybefore urgency. Evidencebefore alarm. Judgmentbefore speculation.
Discipline
Assess exposure. Explain the response. Support execution. Each recommendation connects evidence to a decision your leadership can act on.
How we work together
A defined engagement from the start
Discuss the need.
Tell us what prompted the review and what you need to decide.
Agree on the scope.
Establish the systems, evidence, participants and deliverables before work begins.
Review and act.
Examine the evidence, discuss findings and assign practical next steps.
Follow through.
Add a targeted retest or an ongoing advisory cadence when useful.
Why EXTRIMPA
Strategy. Clarity. Trust.
Three commitments behind every engagement.
Strategy.
Our work supports decisions. Each deliverable gives leadership a clear direction for moving forward, connecting findings to the choices and actions they require.
Clarity.
We translate technical complexity into the language of budgets and board decisions. Each recommendation is clearly explained, traceable and able to withstand scrutiny.
Trust.
Trust is demonstrated through defensible analysis, recommendations supported by evidence and professional decisions that put the client’s interests first.
A clearer starting point
A clear next step starts with a conversation.
Start with a 30-minute introductory conversation about your cybersecurity priorities, assurance readiness, control environment or transaction needs.