Skip to content
CYBER

Choose the smallest engagement that answers the question.

Not every enquiry should become a large consultancy programme. AURMAK offers five clear starting routes, ordered by commitment. An organisation may use one route once, or move from a focused review to improvement and continuing assurance as its needs develop.

Cyber Risk View

A short initial view for an organisation that does not yet know where to begin.

  • An indication of which service area the answers point towards
  • Questions that can be taken to internal teams or an existing provider
  • No continuing commitment unless further help is requested

Themed or Focused Review

A defined review when the area is known but the detail is not. Typical triggers include a customer request, audit, cloud change, supplier concern, operational system or control that has not been proven.

  • Evidence based findings for the selected theme
  • A prioritised remediation plan
  • The relevant deliverable, such as a design pack, gap report or control register

Enhancement or Improvement Programme

Delivery support when the organisation wants help closing findings rather than only receiving a plan.

  • Support with remediation, design and implementation
  • Evidence recorded as work progresses
  • Progress reporting against agreed outcomes and closure decisions

Retained Security Leadership and Virtual CISO

Senior security leadership on a defined rhythm for organisations that need accountable direction without building a full internal function immediately.

  • A named senior adviser
  • Regular risk, remediation and governance review
  • Leadership reporting and security input into significant business change

Continuous Control and Security Assurance

Periodic review of risk, controls and evidence after an assessment or improvement programme.

  • Regular control and evidence assurance
  • Risk and remediation review
  • Supplier, policy, incident exercise and customer assurance support as agreed
Book a security review

How fees are set.

The scope, assumptions, client input, exclusions and fee basis should be stated in writing before work begins. Fixed fees suit bounded reviews. Programmes and retained services should use defined stages, time allocations or review points so cost and responsibility remain clear.