Scope and intake
We agree the systems in scope, the time box and the data-handling terms under a mutual non-disclosure agreement (NDA), using anonymised inputs.
Evidence-led review
The Review
We capture the current state, compare belief with evidence, and turn that into a practical sequence of actions.
What the Review is designed to do
The Review is a practical look at privileged access: who holds it, who owns and reviews it, what evidence exists, and which controls are already in place.
At the end, you get a short list of what the evidence shows, why it matters, who owns it and what a practical low-effort fix looks like.
Important: Every finding is linked to evidence. Where we cannot obtain evidence, we record it as “cannot verify”, never “fine”.
What we look at
- Privileged accounts and groups
- Ownership and review quality
- Service accounts and local admin risks
- Access approvals and change control
- Utilisation of tools already owned
- Evidence quality and operational gaps
Six stages
A clear, repeatable process
Current-state capture
We record settings, configurations, policies and processes as found, each with its source.
Gap finding
We compare what the organisation believes with what the evidence shows, and state the risk in plain language with a proposed owner.
Utilisation check
We compare the capabilities already owned with what is switched on and in use. Closing that gap can be a low-effort improvement.
Fix design
We design a practical, low-effort fix using tools already in place, with a runbook that states who runs it, how often, and what happens if that person is unavailable.
Handover
You receive the evidence pack, prioritised actions, named owners and a review date.
Automation boundary
What runs without a person and what needs a named approver
| Task | Runs without a person | Needs a named approver |
|---|---|---|
| Inventory and evidence collection | Yes | No |
| Comparing access lists against records | Yes | Final decision on any removal |
| Routine reporting and evidence packaging | Yes | No |
| Password requests and access grants | No | Yes |
| System changes and emergency access use | No | Yes |
What a client receives
Practical fixes and a runbook
- Evidence pack with the findings, sources and assumptions
- Prioritised actions with named owners
- A practical fix plan using tools already in place
- A runbook stating who runs the task, how often and what happens if that person is unavailable
- A review date and a clear handover back to the business
Describe the problem in anonymised terms.
A mutual NDA comes first if you want one.