Readiness programs for audit pressure, AI adoption, and identity risk.

Best fit

For organizations adopting ChatGPT, Copilot, Claude, Gemini, or AI-enabled SaaS without clear guardrails.

Primary outcome

Discover unmanaged AI usage, reduce data exposure, and produce an executive-ready AI governance roadmap.

Core outputs

• Shadow AI discovery and risk inventory
• AI acceptable-use policy and data-handling rules
• AI vendor and tool risk review

Additional scope is finalized during discovery.

Best fit

For SaaS, AI, fintech, and B2B teams responding to enterprise customer security reviews.

Primary outcome

Move from scattered controls to a structured SOC 2 readiness plan with evidence owners and audit-prep priorities.

Core outputs

• Trust Services Criteria gap assessment
• Control and evidence mapping
• Policy and documentation pack priorities

Additional scope is finalized during discovery.

Best fit

For organizations preparing for ISO 27001 certification or building a stronger security management program.

Primary outcome

Define ISMS scope, risk methodology, control roadmap, and operating model without overwhelming the team with documentation.

Core outputs

• ISO 27001 gap assessment
• ISMS scope and Statement of Applicability support
• Risk assessment methodology and treatment plan

Additional scope is finalized during discovery.

Best fit

For Canadian government vendors, public-sector teams, and regulated organizations requiring ITSG-33-aligned security support.

Primary outcome

Translate security controls, risks, and evidence into an assessment-ready package aligned to Canadian public-sector expectations.

Core outputs

• ITSG-33 control alignment review
• Security assessment gap analysis
• Risk treatment and remediation roadmap

Additional scope is finalized during discovery.

Best fit

For teams with manual access reviews, fragmented identity systems, privileged-account sprawl, or audit pressure.

Primary outcome

Reduce identity and privileged-access risk with a practical roadmap for Okta, Entra ID, SailPoint, CyberArk, or BeyondTrust environments.

Core outputs

• IAM/PAM current-state assessment
• Joiner-mover-leaver and access review maturity review
• Privileged account discovery approach

Additional scope is finalized during discovery.

Best fit

For organizations requiring senior security leadership without a full-time CISO hire.

Primary outcome

Ongoing security roadmap ownership, executive reporting, audit readiness, vendor oversight, and governance support.

Core outputs

• Monthly executive risk review
• Security roadmap and policy oversight
• Board-ready reporting and risk register maintenance

Additional scope is finalized during discovery.