We define the scope, assess the current position, coordinate remediation and prepare useful evidence—while keeping consultancy, independent audit and certification roles explicit.
A scheme- or framework-aware plan showing applicable requirements, evidence gaps, control owners and the route to independent assessment where required.
Choose the closest situation. This changes the context carried into your brief.
The exact statement of work follows discovery; these are the normal components and outputs of this service.
Readiness, remediation, independent assessment and certification are different roles. We name each one before work starts.
| Route | Assurance method | What changes |
|---|---|---|
| Cyber Essentials | Verified self-assessment | Five technical-control areas with answers reviewed by a qualified external assessor. |
| Cyber Essentials Plus | Independent technical audit | The same controls with technical testing to verify that they are implemented. |
| IASME Cyber Assurance Level One | Verified assessment | A broader cyber-resilience standard; a valid Cyber Essentials certificate is a prerequisite. |
| IASME Cyber Assurance Level Two | Independent audit | The Level One controls are examined through evidence, interviews and observed practice. |
| IASME Quality Principles | Additional quality route | Applicability and evidence are confirmed before it is included in an assurance plan. |
| ISO/IEC 27001 | ISMS and independent certification | Risk, governance, policies, controls and continual improvement are organised within a defined ISMS scope. |
| NHS DSPT | Online self-assessment toolkit | Applicable assertions and evidence demonstrate how health and care information is handled securely. |
| NCSC CAF | Outcome and maturity assessment | Cyber-resilience outcomes are assessed against the relevant sector and regulatory context. |
| NIST CSF and CIS Controls | Profile, maturity and control mapping | A current state is translated into prioritised governance, protection, detection, response and recovery work. |
| PCI DSS and customer assurance | Scoped compliance support | Payment-data or supplier requirements are mapped to evidence, remediation and the appropriate assessment route. |
Current Cyber Essentials rules and licensed Certification Bodies are published by IASME ↗.
Current IASME Cyber Assurance levels, prerequisites and assessment routes are published by IASME Cyber Assurance ↗.
PlatformsScheme-led and platform-independent, with technical evidence gathered from the actual identity, device, network, cloud and supplier environment in scope.
AfterwardsSudo can coordinate remediation, evidence maintenance, annual readiness and improvement work between independent assessments.
Confirm the business outcome, scheme, level, scope and prerequisites.
Translate applicable requirements into systems, evidence and named owners.
Review the current controls, documentation and operating reality.
Prioritise and coordinate the changes needed before assessment.
Check evidence, people and systems against the intended assessment route.
Hand over to independent assessment and retain an owned improvement plan.
The exact scope follows discovery. These are the questions that usually need an early answer.
The current situation, the outcome you need, the systems or evidence in scope, the decision owner and any deadline or assurance requirement.
Yes. We make responsibilities, access, handoffs and retained ownership explicit rather than assuming a replacement model.
We agree whether the result is handed to your team, supports a defined remediation project or moves into a separately scoped ongoing service.
Bring the current system, constraint or decision. The selected context will already be in the brief.
