Clear decisions for
critical operations.

One site or agreed remote boundary; current diagrams; available asset information; relevant policies; up to six stakeholder interviews; evidence supplied by the customer.

Confirm operational scope and constraints; review architecture and sampled evidence; assess applicable controls; examine operational risk scenarios; validate findings with owners; prioritise a 12-month roadmap; brief management.

Remote-led, one agreed environment, up to six interviews, one management readout and one consolidated factual-correction round.

Excluded: Intrusive scanning, penetration testing, exhaustive asset discovery, certification, implementation and a guarantee of risk reduction.

One architecture or change proposal; diagrams; data flows; security requirements; operational constraints; supplier design information.

Review trust boundaries, zoning, remote access, identity and resilience; examine failure scenarios; discuss design decisions; record requirements and unresolved issues.

One bounded design, two review meetings and one factual-correction round. Range £2,500–£5,000; £3,500 is the standard scoping assumption.

Excluded: Detailed implementation, formal safety engineering, full site assessment and supplier product certification.

Up to three supplier arrangements at one site; access diagrams; account/control descriptions; approvals and redacted logs.

Document each access path; assess authentication, privilege, endpoint assurance, monitoring and expiry; review emergency and subcontractor access; validate exceptions.

Up to three documented supplier arrangements and one remote workshop.

Excluded: VPN/PAM implementation, direct account testing, vendor audits and continuous monitoring.

One site/boundary design; network and zone diagrams; flow requirements; sampled rule descriptions; maintenance constraints.

Review zones, conduits, boundary controls, management paths and dependencies; examine feasible improvement options with operations.

One agreed site/boundary with supplied documentation; detailed rulebase volume agreed before contract.

Excluded: Live firewall changes, full packet capture, active network discovery and implementation validation.

Agreed baseline; action register; changed designs/suppliers; updated evidence and customer progress reports.

Monthly risk/action review; sample closure evidence; review agreed changes and exceptions; escalate blockers; quarterly management summary.

Two practitioner days per month planned in advance; monthly meeting; quarterly report. Initial three-month term proposed.

Excluded: 24/7 monitoring, incident response SLA, unlimited architecture review and execution of customer remediation.

Business objectives; governance; risk position; programme plan; decisions needing specialist advice.

Agree 90-day priorities; chair agreed governance discussions; review architecture and investment decisions; support stakeholder and supplier challenge.

Four practitioner days/month, including the Continuous Assurance allowance where appropriate. Initial three-month term proposed.

Excluded: Statutory director/CISO accountability, 24/7 availability, unlimited delivery and responsibility for customer risk acceptance.

One scenario; participant roles; existing response/recovery plans; constraints and exercise objectives.

Prepare fictional scenario and injects; facilitate a half-day decision exercise; capture observations; debrief and assign lessons.

One tailored scenario, up to 12 participants, one half-day facilitated session and debrief.

Excluded: Live production changes, red teaming, technical incident handling and a pass/fail certification.

Audience, business context, learning objectives and approved discussion examples.

Tailor content; deliver a half-day workshop; discuss responsibilities and realistic decisions; capture agreed next steps.

One half-day workshop for up to 15 participants, with one preparation meeting.

Excluded: Accredited qualifications, multi-day technical training and customer-specific assurance findings.

Up to three existing site assessments using a comparable scope; group governance; site priorities and action registers.

Check comparability and gaps; normalise findings; identify group dependencies and critical exceptions; prioritise programme governance and investment.

From £14,500 for review of up to three existing site assessments. New assessments or visits are separately scoped.

Excluded: Three complete new site baselines at the starting price; implementation and unsupported portfolio risk averages.