Security assessments
A current-state view of controls, risk, and exposure, written so both technical teams and leadership can act on the same document.
Governance, Risk & Compliance
GRC & Strategy
Turning security requirements into practical, measurable controls that leadership and auditors can rely on — and a plan for closing the gap between where you are and where you need to be.
You receive a gap assessment, risk register, control mapping, policies, and a remediation roadmap.
What we offer
Areas of work.
The exact combination is agreed during scoping rather than assumed — these are the areas an engagement is built from.
Gap assessments
Comparing what you have against the standard or requirement you are working toward, and naming the specific gaps rather than a score.
ISO 27001 readiness
Advisory work preparing an organisation for ISO 27001 — scoping, gap analysis, documentation, and implementation guidance ahead of an external audit.
Risk and control planning
Building a risk register and mapping controls to the risks they actually address, so control decisions have a stated reason.
Security policies and documentation
Drafting policies and supporting documentation that reflect how your organisation really operates, rather than templates nobody follows.
Implementation guidance
Practical support turning the roadmap into implemented controls, sequenced by risk and by what is realistic for your team.
How we help
How an engagement runs.
We start by establishing what you are actually required to meet and what is already in place, then document the gap honestly. The output is a prioritised roadmap with control ownership and sequencing — the work leadership needs to fund it and engineers need to implement it.
Explore our approachWhat you get
Deliverables.
GOVERNANCE, RISK & COMPLIANCE
Engagement output
- Gap assessment
- Risk register
- Control mapping
- Policy recommendations
- Remediation roadmap
The exact artifacts depend on what the engagement covers, and are confirmed during scoping.
Who it's for
Organisations building security governance or preparing for regulatory and compliance requirements.
Organisations preparing for ISO 27001Teams facing customer security reviewsRegulated organisationsOrganisations building a security programmeLeadership needing a risk view
Related evidence
What the work looks like.
Governance work still has to rest on technical findings. The sample report shows how risk is presented so leadership can act on it and engineers can fix it from the same document — the format a gap assessment or risk register is built to feed. It is a demonstration rather than client work.
Scope
What this service is, and what it is not.
Being clear about the limits matters as much as describing the work.
Readiness and advisory, not certification
We prepare organisations for ISO 27001. O&D Cyber is not a certification body, does not issue certificates, and does not perform certification audits — those are carried out by an accredited external body.
Guidance, not a compliance guarantee
The work improves your control posture and readiness. No outcome with an external auditor or regulator is guaranteed, and nothing here is legal advice.
Request this service
Request GRC & Strategy.
Tell us which standard, customer requirement, or internal goal you are working toward. We will review the context and come back with a scope that fits.