What to expect from an engagement with Securious

If you’ve never worked with a cyber security provider before but want to understand how an engagement with one might work before you take the leap of getting in touch, read on. Because in this article, we explain what you can expect from an engagement with Securious. This covers the process we follow to ensure you receive the best service to get your organisation in good cyber shape.

Step one – knowing where to start

We start off by arranging a call or face-to-face visit, where we will discuss:

Your motivation and objectives

First, we need to understand why you’ve got in touch with us. Once we’ve clarified your objectives and motivation, we can understand how best to help you.

For example, have you had a request from a stakeholder for compliance due diligence? Or maybe you’ve recently been appointed with the responsibility of cyber security, and you want some outside support to help you get there? Or perhaps your organisation is bidding for a new contract with cyber security requirements?

In most cases, we find that our clients’ motivations and objectives fall into two categories:

1) Compliance renewal, known security task or enhancement 

This may mean you want to achieve or renew compliance, or a certification/accreditation such as Cyber Essentials, PCI DSS compliance or ISO 27001. Or perhaps you need penetration testing to ensure your systems are not vulnerable to cyber criminals. In some cases, clients want to address a particular security vulnerability or weakness.  For example, staff awareness of cyber security best practice. Generally, clients seek these services either because it’s desired internally or required by stakeholders.

2) You know you need something – but what? 

Alternatively, you may have been hearing about the importance of cyber security and want to make sure you’re in good shape, but you’re not sure where to start. In this case, we may collectively decide that a cyber security audit would be beneficial for your organisation.

The project scope and your requirements

Once we’ve established why you’ve contacted our team and what your drivers are for the project, we need to clarify the scope and define your requirements.

This will involve you providing us with an overview of your environment and available resource so we can ensure that we provide the best, tailored solution for your needs.

Based on this, we’ll create engagement documents and a proposal that you’ll need to sign. This is so we all understand exactly what we will be doing as part of the project.

Step two – getting started

Depending on your required service, this stage will vary. And we understand that not everything can be fixed overnight. Factors like resource and cost are a challenge to balance for any organisation.

Penetration tests

If you need a penetration test, we’ll agree on dates with a defined boundary and permissions in place. Our pentester may request some information before the test.  Then on the agreed date, they will perform testing against the agreed areas.

You can read more about our pentesting process and what we’ll need from you beforehand in this blog.

Compliance, accreditations and certifications

For cyber security compliance, accreditations or certifications, the next step is to conduct a gap analysis. This essentially means we look at where you are now against where you need to be to achieve compliance, or the accreditation/certification you desire.

Gap analyses and health checks take into consideration your whole estate, including infrastructure, processes, procedures and documentation. It’s always useful to know where to start for a new implementation or when updating your alignment to a new version of the security standard (such as the new PCI DSS Version 4)

Cyber security audits

We’ll arrange for a date to conduct an audit. We may agree to do it remotely or on-site, depending on your environment. One of our experienced cyber security consultants will then conduct the well-defined audit or security health check

Step three – reporting and debriefing

Whatever project we’re working on together, once we’ve come and had a look around your business, whether with a penetration test, gap analysis or cyber security audit, the next stage will be to create a report and talk you through it.

Our reports will detail the good, the bad and the areas where urgent action is needed. We will also include a prioritised action list so you know what you need to do.

We’ll debrief every report with your team and answer any questions you may have. This is to ensure you’re ready to take the immediate actions needed to remediate your environment and meet best practice.

Step four – remediation

The above stages are very much the beginning (we hope) of an ongoing journey and relationship with Securious. By this stage, you will know your areas of concern and the next steps required to meet compliance and/or better protect your environment.

Securious will help guide you and confirm remediation is implemented and effective as you progress through the prioritised actions.

For larger projects such as implementing Payment card compliance (PCI DSS) or an Information Security Management System (ISO 27001) for the first time, a project plan managed by Securious will monitor and keep us on track for the scheduled delivery of individual tasks or requirements identified in the initial gap analysis.

Throughout this period, Securious will be only a phone call or email away.  Whether you need us onsite, at a remote meeting or have a burning question, we will be happy to help.

Be sure that we will keep in communication with you. Whether this was a standalone project to prioritise risk mitigation, or the start of a larger compliance piece to gain certification.

Step five – assessment/compliance report

If you were aiming to achieve compliance or an accreditation/certification, once you’ve completed the prioritised actions from the report, the time will have come for assessment.

This will be the required compliance documentation signed by our qualified and registered assessors or an assessment report based upon a recognised industry standard.

This report is submitted to the authorising body for compliance or is used as 3rd party evidence for your team. This can be shared with any interested party and stakeholder as proof of your current security posture.  The reports are constructed with an executive overview of risk, as well as a technical section detailing observations, risks and recommendations.

Once you have had time to digest these reports, we will of course be available to discuss and answer any questions with your team. This ensures continuous improvement and maximum effect of results.

Post project

Once your project has been successfully completed, Securious will still be here. We will keep in touch and are always more than happy to answer any questions you might have. We are always available on the end of the phone. Really, we aim to become a trusted extension of our clients’ organisations.

Additional improvements you might consider

We all know cyber security is constantly evolving and that its consideration should be standard for businesses. But how do you keep ahead of the threats and understand your ever-changing vulnerabilities in the cyber security landscape?

Securious provides various solutions for ongoing monitoring and measuring of your organisation’s cyber security posture. This ranges from regular audits and reviews to monthly vulnerability scanning to staff training via the phishing and awareness platform, ‘KnowBe4’.

However, the most effective solution to understand what is happening is our MDR solution, based on Monikal, the Securious SOC/SIEM. With this solution, our analysts constantly have eyes on your whole environment. They will swiftly alert you to any threats to prevent them from evolving into incidents wherever possible.

Final thoughts

Cyber security can be daunting – especially if it’s not an area you’re familiar with. But here at Securious, our priority is making you feel confident in your cyber security. We want our clients to feel confident in where they are, confident they know what they need to do, and confident that we are here to help them. Whatever it is they need.

So if you’re ready to start your cyber security journey with Securious, just get in touch using the contact form below.