Services
Most businesses do not need all 23 services at once. They need the right starting point, the right evidence, and the right operating structure for the questions they're getting right now.
Choose the pressure
Pick the situation that feels closest. You will get one recommended first move, one likely starting tier, and only the next options worth looking at.
Start here
This page is here to shorten the decision, not turn it into another research project. Choose the situation that sounds closest and start with the service that usually removes the friction fastest.
Ready first · Evidence before diligence
Start with the services that give you usable answers, evidence, and ownership before buyer diligence turns into delay or loss.
Start with
Start here because it turns buyer questions into a usable response pack, evidence set, and repeatable answer process instead of another scramble.
What changes after it lands
The business can answer due diligence with something credible before the deal slows down.
Why this tier usually fits
Up to 8 security questionnaire responses per year with 3-business-day turnaround
Can deepen into Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Customer Requirements Register
Use this next when multiple buyers are asking for different things and the obligations need one owner.
Usually starts in Assurance
Read service pageYou may need next
Security Baseline Assessment
Use this if the answers are weak because the underlying control picture is still unclear.
Usually starts in Baseline
Read service pageIf the foundations are still missing
If nothing structured exists yet, start with the Security Baseline Assessment first so later questionnaire work is built on something real.
See the fallback starting pointRenewal-ready · Evidence pack
Use the services that tighten insurer-facing controls, evidence, and response structure before pricing, exclusions, or denied claims do the damage for you.
Start with
Start here because it shows what the underwriter will challenge, what evidence is missing, and what needs fixing before renewal gets harder.
What changes after it lands
The business gets a clearer renewal path instead of guesswork and weak answers.
Why this tier usually fits
Basic readiness assessment with gap identification and improvement guidance
Can deepen into Assurance and Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Security Baseline Assessment
Use this when the insurer questions expose broader gaps and the business still needs a clearer control picture.
Usually starts in Baseline
Read service pageYou may need next
Incident Response Plan Suite
Use this when the underwriter pressure is exposing weak incident structure, not just weak paperwork.
Usually starts in Baseline
Read service pageCompliance-ready · Privacy obligations
Start with the services that show what personal data you hold, where it moves, who owns the decisions, and what to do when a privacy event lands.
Start with
Start here because you cannot improve privacy decisions if nobody can clearly show what personal data exists, where it moves, or who owns it.
What changes after it lands
The business gets one usable view of personal data and the decisions attached to it.
Why this tier usually fits
Basic personal data inventory for Privacy Act compliance with annual review
Can deepen into Assurance and Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Privacy Impact Assessment
Use this when a new project, supplier, or system change needs its privacy risks tested properly.
Usually starts in Assurance
Read service pageYou may need next
Privacy Breach Readiness Report
Use this when the bigger fear is not the law change itself, but how the business would respond if something went wrong.
Usually starts in Baseline
Read service pageIt happens here · NZ businesses at risk
Use these services to tighten response structure, readiness, and the most obvious control gaps before luck runs out.
Start with
Start here because when the risk suddenly feels real, the first job is response structure so the first 72 hours are not chaos.
What changes after it lands
The business gets a practical response path before the first serious incident lands.
Why this tier usually fits
Core 5-plan suite covering the most common incident scenarios
Can deepen into Assurance and Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Security Baseline Assessment
Use this when the headline incident has exposed broader control gaps and nobody knows where the real exposure sits.
Usually starts in Baseline
Read service pageYou may need next
Privacy Breach Readiness Report
Use this when the likely incident would involve customer or staff data and the notification path feels shaky.
Usually starts in Baseline
Read service pageGrowing pains · Scaling securely
Start with the services that convert enterprise requirements into evidence, registers, governance, and reporting the business can actually sustain.
Start with
Start here because it turns scattered customer demands into one working register so the business can see what is being asked and what still needs ownership.
What changes after it lands
The business gets one credible view of customer requirements instead of reactive firefighting.
Why this tier usually fits
Customer requirements tracking with control mapping and annual impact assessments
Can deepen into Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Security Questionnaire Response Engine
Use this when the immediate problem is answering a live questionnaire without losing the deal.
Usually starts in Assurance
Read service pageYou may need next
Multi-Standard Compliance Mapping
Use this when multiple frameworks or customer standards need one joined-up answer rather than manual translation every time.
Usually starts in Assurance
Read service pageIf the foundations are still missing
If the business still lacks a credible control baseline, start there first so customer-facing evidence is not built on assumptions.
See the fallback starting pointPersonal accountability · Directors' duties
Use the services that make ownership, risk, reporting, policy, and board-level decisions visible before an insurer, customer, or regulator forces the conversation.
Start with
Start here because the first gap is usually decision-grade reporting and ownership, not another loose technical task list.
What changes after it lands
Leadership gets a clearer governance rhythm, better visibility, and firmer decision support.
Why this tier usually fits
Available as an add-on at +$1,000/month. Quarterly governance reporting and presentation materials.
Can deepen into Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Risk Management Framework
Use this when leaders need a clearer way to decide which risks matter, which can wait, and who owns the response.
Usually starts in Assurance
Read service pageYou may need next
Policy Suite & Lifecycle Management
Use this when accountability is weak because the policy set is old, thin, or no longer trusted.
Usually starts in Baseline
Read service pageIf the foundations are still missing
If leadership still lacks a credible baseline to govern, start there first so the reporting has something real underneath it.
See the fallback starting pointFirst steps · Where to begin
Start with the services that show where the exposure really sits, what assets and data matter most, and which next step is actually worth doing first.
Start with
Start here because it gives the business one credible picture of what matters, what already exists, and what should happen next.
What changes after it lands
The business gets a prioritised starting point instead of twenty disconnected tasks.
Why this tier usually fits
Full assessment at onboarding plus annual refresh
Can deepen into Assurance and Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Information Asset Register
Use this when the real blocker is not knowing which systems and information assets matter most.
Usually starts in Baseline
Read service pageYou may need next
Personal Data Inventory
Use this when uncertainty is mostly about customer or staff data and privacy exposure.
Usually starts in Baseline
Read service pageRecovery mode · Audit remediation
Use the services that turn findings into evidence, corrective actions, and a defensible recovery path before the next review lands.
Start with
Start here because the first step is to turn the failed review into a clear evidence and remediation picture before the next review lands.
What changes after it lands
The business gets a defensible recovery path with clearer priorities and evidence gaps.
Why this tier usually fits
Audit readiness scoring and evidence compilation for primary compliance framework
Can deepen into Leadership if the pressure is heavier or the delivery scope needs to widen.
You may need next
Audit Finding & Corrective Action Tracking
Use this when the main problem is tracking findings, owners, and progress after the audit has already gone badly.
Usually starts in Leadership
Read service pageYou may need next
Customer Requirements Register
Use this when the failed review sits inside a broader set of customer obligations that still need one working owner.
Usually starts in Assurance
Read service pageIf the problem is broader
Use this only if the trigger cards above still feel too specific.
Pressure route
Use this when deals, renewals, or procurement are waiting on clear security answers and usable evidence.
3 services usually fit this route.
Pressure route
Use this when the business needs one credible view of gaps, priorities, and ownership before pressure gets worse.
3 services usually fit this route.
Pressure route
Use this when directors or owners need reporting, governance rhythm, and clearer investment trade-offs.
7 services usually fit this route.
Pressure route
Use this when privacy changes, supplier risk, audit prep, or overlapping compliance demands are already live.
7 services usually fit this route.
Pressure route
Use this when the business needs response plans, breach readiness, or access-change discipline before the first real incident.
2 services usually fit this route.
Still comparing options?
Keep this closed unless you really want to browse every category. The faster path is still the recommendation flow above.
Core foundation
Use this when the business needs one credible view of gaps, priorities, and ownership before outside pressure gets worse.
3
Reporting rhythm
Use this when leadership needs a reporting rhythm and clearer trend visibility after the first baseline work is already underway.
3
Visibility and ownership
Use this when the business needs to know what matters, who can reach it, and how access changes are handled when people join, move, or leave.
2
Privacy and supplier pressure
Use this when supplier risk, project privacy changes, or breach-readiness obligations are already starting to create friction.
3
Audit and evidence
Use this when questionnaires, audits, evidence requests, or overlapping customer requirements are already active.
5
Incident readiness
Use this when the business needs practical response structure before a real incident forces the first serious test.
1
Governance and direction
Use this when leadership needs policy ownership, board reporting, risk governance, or clearer programme direction.
5
Book a free consultation and leave with the first move that makes sense, the service that fits, and the package level most likely to work now.
