A gap analysis tells you what is wrong. BUILD is the phase that fixes it — architecture, control design, implementation procedures, configuration guidance, and the validation criteria your technical teams need to know the work is done correctly.
CISSP · CRISC · CCSK · CCZT | 29+ years in cybersecurity | Scoped before work begins | Veteran-owned
Most teams leave an assessment with a spreadsheet of findings and no clear idea of what to change, in what order, or how to prove the change worked. The controls that matter most are usually the ones that need real technical design, not a policy document.
Cyberneza develops the architecture, technical recommendations, implementation procedures, configuration guidance, and validation criteria. Your technical teams normally execute approved production changes through their established change-management process — so control of your environment stays where it belongs.
Six named artifacts. Every one of them is a document or working record you keep, not a meeting you attended.
Architecture and technical design for each control in scope, written for engineers rather than auditors: the design decision, the alternatives considered, the requirement it satisfies, and the constraints it has to live inside. One entry per control — see the worked example below.
The work ordered by dependency, risk, and business impact, with each item's prerequisite named. A delayed item shows what it blocks, so a slip is visible the week it happens rather than at the readiness review.
Step-by-step procedures your team can follow, repeat, and hand to someone new — written against your actual platforms, not a generic runbook with the product names changed.
An explicit pass/fail test per control, agreed before the work starts, so "done" is something both sides can check rather than something either side can claim.
What each closed control must produce on an ongoing basis, where it comes from, and how often — defined alongside the control so the READINESS review is a review and not an archaeology exercise.
A maintained record of control state, owner, and open items, plus the decisions taken during the engagement and why — including risks deliberately accepted. This is what an assessor asks for a year later and what nobody can reconstruct from memory.
The finding and design format is the same one used across the practice. See the methodology →
The unit of a BUILD deliverable is not a chapter, it is an entry like this one. A typical engagement produces dozens.
Requirement. SOC 2 CC6.1 and CC6.3 · NIST SP 800-171 3.1.1, 3.1.5, 3.1.7 · ISO/IEC 27001 A.8.2. Limit privileged access to authorized users and enforce least privilege.
Current state. Twelve engineers hold standing administrative credentials to the production environment. Access was granted at hire and has never been reduced. There is no record of who approved each grant and no review has been performed.
Design decision. Move standing administrative access to time-bound elevation requested through the existing identity provider, with approval by a second person and automatic expiry. Two named break-glass accounts remain standing, stored offline, alerting on every use. Rejected alternative: a privileged access management appliance — it solves the same problem, but the identity provider already in place covers this scope without adding a system to operate, and the difference is months of work.
Implementation procedure (excerpt). Create the elevation-eligible role group and map it to the production administrative role. Configure the elevation request with a maximum duration, mandatory justification, and approver group. Remove standing assignments in an agreed order, engineering-tooling roles last. Configure the break-glass accounts, exclude them from conditional-access policies that could lock them out, and route their sign-in events to a dedicated alert.
Validation criterion. No human account holds a standing production administrative assignment except the two break-glass accounts. An elevation request with no approval and no justification is rejected by the system, not by a person. A break-glass sign-in raises an alert within five minutes.
Evidence expectation. The elevation request log (requester, approver, justification, duration) exported quarterly; the standing-assignment report from the identity provider at each access review; the break-glass alert configuration and any triggered alerts with their disposition.
Effort and owner. Roughly one to two weeks of engineering effort spread across a change window, owned by the platform engineering lead with the security owner approving the design. Cyberneza writes the design, the procedure, and the criteria; your team executes the change through your change-management process.
There is no single honest number, and a firm that quotes one before seeing your environment is quoting a template. What can be said before a call is what drives it and what is fixed regardless.
Stated up front, because the expensive misunderstandings in this kind of work are always about the boundary rather than the work itself.
BUILD is scoped after a call. The environment, deadline, technical complexity, and amount of support required all change the work, so the price is established before the engagement begins.
Cyberneza produces the design, procedures and criteria. Customer technical teams normally execute approved production changes through their own change-management process.
Evidence expectations are defined with each control so READINESS is a review, not a scramble.
Cyberneza develops architecture, technical recommendations, implementation procedures, configuration guidance, and validation criteria. Customer technical teams normally execute approved production changes through their established change-management process. That boundary keeps control of your environment where it belongs and keeps your change records intact.
It depends on the environment, deadline, technical complexity, and amount of support required. Cyberneza scopes the work first and establishes a fixed fee for that written scope before the engagement begins — so the number is fixed for you, it just cannot be fixed for everyone in advance.
No, but it usually saves money. ASSESS establishes what actually needs building, and 100% of it is credited toward your next engagement when it starts within 90 days. See ASSESS pricing →
It gets renegotiated in writing before any extra work happens, not absorbed silently and not invoiced afterwards. If the scope shrinks because something was already in place, that is said out loud too.
Yes, and that is the normal arrangement. Designs and procedures are written to be raised as changes in your process, with your approvals and your records — which is also what produces the evidence an assessor will later ask for.
Through READINESS. Evidence expectations are defined with each control during BUILD, so the readiness review validates the implemented state against them rather than discovering what should have been collected. See READINESS →
We will scope the smallest engagement that moves the work forward, and establish the fee before work begins.
