Cybersecurity and technology risk services
Choose the support your organization needs.
Prepare for customer security reviews, strengthen your control environment and address defined assurance or regulatory priorities. Services include SOC 2 and ISO/IEC 27001 readiness, HIPAA Security Rule readiness, framework-aligned assessments, RIA-focused Regulation S-P advisory and M&A cyber due diligence.
01 / Regulation S-P
Regulation S-P readiness
Your policies are in place. You need to understand how responsibilities, procedures and controls operate in practice.
- The work
- Review selected program elements, incident procedures, provider responsibilities and supporting control evidence alongside your Chief Compliance Officer (CCO) and legal counsel.
- What you receive
- A program-to-evidence matrix, documented gaps and a prioritized follow-up plan. Incident tabletop exercises can be included in the agreed scope.
02 / Assessments
Cybersecurity and control assessments
You need a current view of your controls before deciding where to invest time and resources.
- The work
- Examine the agreed environment through interviews, documentation and selected control tests. Distinguish design weaknesses, operating issues and missing evidence.
- What you receive
- An assessment report, documented findings and a prioritized action plan with proposed owners.
03 / Incident readiness
Policies and incident readiness
Your procedures need updating, or your team needs to rehearse who does what during a disruption.
- The work
- Review selected policies, clarify responsibilities and facilitate a tabletop exercise with leadership, compliance, counsel and technology providers.
- What you receive
- Revised procedures within scope, a responsibilities and escalation map, exercise observations and a follow-up action list.
04 / Control testing
Control testing and remediation
A control needs to be tested, or an identified issue needs a clear path to resolution.
- The work
- Agree the control objective and test procedure, examine evidence, document exceptions and assess corrective actions where retesting is included.
- What you receive
- Test results, exception records, remediation criteria and retest conclusions. Targeted implementation can be scoped separately.
05 / Ongoing advisory
Ongoing technology risk advisory
You need senior review and consistent follow-up as systems, providers and priorities change.
- The work
- Establish monthly or quarterly reviews of agreed risks, control evidence, provider questions and remediation actions.
- What you receive
- A review calendar, updated action records and concise management reporting to support decisions and track follow-through.
06 / Assurance readiness
SOC 2 and ISO/IEC 27001 readiness
Customers are asking for stronger assurance, or your organization is preparing for a SOC 2 examination or ISO/IEC 27001 certification.
- The work
- Define the systems and services in scope, assess current practices against relevant SOC 2 Trust Services Criteria or ISO/IEC 27001 requirements, and identify gaps in governance, risk treatment, controls and evidence. Support a practical implementation plan, control ownership and evidence preparation.
- What you receive
- A scoped readiness assessment, documented control and evidence gaps, prioritized remediation actions and a clear view of decisions needed before engaging the independent examiner or certification body.
07 / Transactions
M&A Cyber & Regulatory Due Diligence
You need to understand the cyber exposure behind an acquisition, the investment a portfolio company needs or its readiness for sale.
- The work
- Examine the target’s security posture, security-related technical debt and evidence supporting regulatory and contractual commitments, coordinating with counsel on legal questions.
- What you receive
- An investment committee brief, documented findings, remediation cost drivers and a prioritized ownership or exit action plan. Estimates identify assumptions, access limits and items requiring validation.
08 / Frameworks and requirements
Use the framework that fits your obligations.
You need a documented view of how selected controls address a recognized framework, customer expectation or applicable requirement.
- NIST Cybersecurity Framework 2.0
- Build or update an organizational profile, assess current outcomes and prioritize improvements across cybersecurity governance and risk management.
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
- For entities covered by the regulation, map agreed program areas and control evidence to applicable requirements and document gaps for management follow-up.
- New York SHIELD Act safeguards
- Review administrative, technical and physical safeguards relevant to the private information in scope, including risk assessment, service provider oversight and control follow-up.
- PCI DSS
- For environments that store, process or transmit payment card data, review scope, selected controls and evidence to prepare for customer requirements or formal validation.
These are advisory assessments and readiness support, not legal opinions, certifications or independent compliance attestations. Applicability and scope depend on your organization and information; legal counsel advises on legal interpretation. Where PCI DSS validation requires a Qualified Security Assessor (QSA), we coordinate with the QSA responsible for that assessment.
09 / Healthcare
HIPAA Security Rule readiness
You need to understand how security risks to electronic protected health information are identified and addressed across your systems and service providers.
- The work
- For organizations subject to HIPAA, examine agreed systems and workflows involving electronic protected health information (ePHI), perform a documented security risk analysis, and review relevant safeguards, evidence and business associate responsibilities.
- What you receive
- A scoped risk analysis, documented control and evidence gaps, and a prioritized risk management plan with practical follow-up actions.
The engagement focuses on security risk and controls. It does not certify HIPAA compliance or provide legal advice about whether HIPAA applies to your organization; involve qualified counsel for legal interpretation.
A scope that fits
Connect the review to your environment.
Cloud access and configuration, vendor oversight and business continuity can be included where they relate to your priorities.
Before work starts, we agree the systems, participants, evidence, deliverables, timing and fees. Your leadership retains risk decisions and your counsel advises on legal obligations.
How the scope is defined
We agree access and information-sharing arrangements before any technical activity. Testing is consultative and does not provide an independent assurance opinion. Live incident response, forensic investigation, help desk support and 24/7 monitoring are outside the standard advisory scope.
When implementation is included, we document permissions, change ownership, rollback arrangements and completion criteria. Any involvement in designing a control is identified when discussing subsequent testing.