Days 1–30 · Establish the baseline
Confirm scope, business-critical services and risk owners. Review existing VAPT findings, identity, backup and cloud controls. Agree a prioritized backlog and acceptance criteria.
90-day remediation program
From findings
to meaningful change.
A focused program to prioritize security gaps, deliver agreed improvements and validate the result.
The program
Three phases. One accountable plan.
Days 31–60 · Deliver the priority fixes
Implement approved changes in controlled batches. Address agreed identity, endpoint, patching, backup and cloud configuration gaps. Record evidence and review progress weekly.
Days 61–90 · Validate and hand over
Retest agreed findings, run a recovery or response exercise, review residual risks and hand over evidence, runbooks and the next-quarter roadmap.
A defined engagement
Know what is included.
Core deliverables
- Baseline risk register and prioritized remediation backlog
- Named owners and weekly progress reviews
- Approved change and validation records
- Retest results and residual risk decisions
- Operational runbooks and 90-day close-out report
Scope comes first
The final scope, capacity, access needs and acceptance criteria are agreed before work starts. Active incident response, new licenses, independent audits, certification and major rebuilds require separate agreement.
90 days describes the planned engagement. It is not a promise to remove every vulnerability, achieve certification or recover from an incident within a fixed time.
Your next step
Start with one priority.
Tell us what needs to change. We’ll help define the scope, the right starting point and what success should look like.
Discuss your priorities