Stage 1
ASSESS — establish where you actually are
Interviews, documentation review, evidence sampling, and configuration review against the
framework in scope. Scores reflect control design and evidence readiness, because a
control that produces no evidence half-exists to an assessor.
Artifact: a written gap assessment — readiness by control domain, findings in the standard format below, and a sequenced remediation plan.
Decision it enables: whether to proceed, what it will take, and whether you need outside help at all.
ASSESS — fixed-fee gap assessment →
Stage 2
BUILD — turn findings into executable work
Security architecture and control design, remediation sequenced by dependency and risk,
implementation procedures and configuration guidance, and the validation criteria that
define "done". Cyberneza designs; your technical teams execute production changes through
your own change-management process.
Artifact: control design, implementation procedures, a sequenced remediation plan, and validation criteria with the evidence each control must produce.
Decision it enables: what your engineers do on Monday, in what order, and how they will know it worked.
BUILD — scope and out-of-scope →
Stage 3
READINESS — test the story before someone else does
Validation of the implemented state, the documentation, the evidence, and control ownership
— against what an auditor, assessor, or enterprise customer will actually sample.
Remaining gaps are named while there is still time to close them.
Artifact: an evidence review with residual gaps, owners, and the exceptions likely to be raised.
Decision it enables: whether to start the audit or observation window now, or to wait.
READINESS — evidence review →
Stage 4
SUSTAIN — keep it true after the report
Ongoing guidance for controls, evidence, risk decisions, architecture changes, and new
contractual or regulatory requirements. Compliance decays quietly; the point of this stage
is that the decay is visible while it is still cheap.
Artifact: maintained control and evidence state, and decisions recorded as they are made rather than reconstructed a year later.
Decision it enables: re-audit, recertification, or a new customer requirement, without a scramble.
SUSTAIN — ongoing advisory →
Not every engagement uses all four. The smallest engagement that moves the work forward is the
right one, and 100% of the ASSESS fee is credited toward a larger package started within 90 days
— which only makes sense for a firm that expects the assessment to be honest.
See pricing →
