Cybersecurity regulatory assessment

What the engagement delivers

We map the business against the applicable directions and sector requirements, compare policies with operating evidence and build a gap register. The output distinguishes a missing document from a control that is not functioning.

1. Agree the entities, services and systems within the assessment boundary.
2. Identify the regulatory questions and the evidence needed to assess them.
3. Compare documented responsibilities with the operating records supplied.
4. Hand over findings with evidence gaps, owners and follow-up actions.

Record the source and period for each assessed requirement. Distinguish an applicability question from a confirmed control gap, and keep unavailable evidence visible.

Information to organise

• Service descriptions
• architecture overview
• incident records
• log policy
• supplier contracts
• sector registrations
• responsible officers.

Provide a system and supplier inventory at the level needed to explain responsibility. Include who can retrieve records, how incidents are escalated and which activities are outsourced. Do not include passwords, private keys or production credentials in the assessment pack.

A design or evidence issue to resolve

A logging policy should be assessed against actual system coverage and retrieval capability. A policy statement alone does not show that investigators could obtain the required evidence.

For example, a policy may assign incident escalation to an employee who has left the organisation. The evidence review should identify the stale responsibility and the operating owner needed to correct it. Whether the technical alerting works requires its own appropriate verification.

Boundaries and next steps

This legal/regulatory assessment is not penetration testing or technical security assurance. Technical validation is a separately defined workstream.

The written scope identifies products, entities, jurisdictions, deliverables and fees. Share an initial description rather than confidential source code or personal datasets through the public enquiry form.

The completion pack records the scope, sources considered, evidence supplied and findings. Remediation implementation, penetration testing, certification and incident response are separate unless expressly included. Closing a finding should point to the evidence that addresses it, rather than simply changing a tracker status.