CybervetterIndependent Cybersecurity Assurance

Practice · 5 services

Vetting

Independent assurance over systems, suppliers and people.

Vetting answers one question: is the thing in front of you what it claims to be. A system, a supplier, a candidate, an acquisition target, a model. The claim is usually made in good faith, and it is usually incomplete.

We assess against a named standard, gather the evidence ourselves rather than accepting a completed questionnaire, and document the method so you can challenge the conclusion. Where we are wrong, we would rather find out from you than have you discover it later.

The output is a judgement you can act on and the evidence underneath it, written so a decision-maker and an engineer can both use the same document.

Services in this practice

System & Architecture VettingIndependent technical assurance over solution architectures, cloud estates and code before you commit.Service detailSupplier & Third-Party VettingKnow what your suppliers actually do with your data — and prove it to your regulator.Service detailPersonnel Security Vetting & Insider RiskLawful, proportionate screening frameworks for the people inside the perimeter.Service detailDigital Vetting & Cyber Due DiligenceCyber due diligence on the company, the counterparty or the asset you are about to acquire.Service detailAI System VettingAssurance over AI systems: the model, the data, the supply chain and the disclosure duty.Service detail

How a vetting engagement runs

  1. 01

    Scope

    What is being vetted, against which standard, and what a pass or a fail means. Agreed in writing before any work starts.

  2. 02

    Evidence

    Gathered directly — configuration, logs, documents, interviews, testing — rather than accepted from a completed questionnaire.

  3. 03

    Assessment

    Measured against a named standard, with the method documented so you can challenge how a conclusion was reached.

  4. 04

    Report

    Written for both a decision-maker and an engineer: the judgement and its consequences, then the evidence and the detail.

  5. 05

    Debrief

    We present the findings, take challenge on them, and revise where the challenge is right.

  6. 06

    Retest

    Included. A finding is not closed until we have verified the fix in place.

Have something vetted

Tell us what needs assessing and against which standard, and we will set out how we would approach it.

Discuss a vetting engagement