Cybersecurity audit & assurance

Cybersecurity audits and gap assessments

Independent gap assessment, control testing and cloud security audits against the standards your customers ask for and the regulation of every country you operate in. Every finding mapped to the control it affects.

Our cybersecurity services

Security leadership

DOJ Data Security Program

Since April 8, 2025, the Justice Department’s Data Security Program (Executive Order 14117, 28 C.F.R. Part 202) has restricted or prohibited U.S. companies from giving China, Russia, Iran, North Korea, Cuba or Venezuela, and people and companies tied to them, access to Americans’ bulk sensitive personal data. Since October 6, 2025, companies with restricted transactions also owe due diligence, an independent annual audit and reporting.

If you have engineers, vendors or investors connected to those countries, we map your data and who can reach it, implement CISA’s security requirements, build the compliance program, and carry out the annual audit. We work alongside your counsel, who makes the legal calls.

International standards

Getting ready for an audit

We get you ready for the audit, or test the controls between audits. We show you how your controls align with international standards. We are not a certification body, and as such we do not issue certificates or attestations: the outcome is an accurate and actionable plan to comply with regulatory standards.

ISO/IEC 27001:2022

Information security management

Readiness for certification: ISMS scope, risk assessment, Statement of Applicability and the Annex A controls, tested before your certification body arrives.

SOC 2

Trust Services Criteria

Readiness for a Type I or Type II report: control design, evidence collection and testing against the criteria your auditor will use.

NIST CSF 2.0

Cybersecurity Framework

Current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover, with the gap between them priced.

CIS Controls v8.1

Critical Security Controls

Implementation Group assessment of the safeguards that stop the most common attacks, ranked by what to do first.

PCI DSS v4.0.1

Payment card data

Scoping, segmentation and readiness against the requirements, before your QSA assessment or self-assessment questionnaire.

ISO/IEC 27017 · 27018

Cloud controls and cloud privacy

The cloud-specific extensions to ISO 27001, for providers and for organizations whose data lives in someone else’s cloud.

Regional regulation

National and sector regulation

Most organizations answer to more than one regulatory body. We map them onto one control set, so a control tested once counts everywhere it applies. If yours is not listed, ask.

Europe & UK

  • NIS2 Directive

  • DORA (financial entities)

  • GDPR Art. 32 security of processing

  • UK Cyber Essentials readiness

  • NCSC Cyber Assessment Framework

North America

  • DOJ Data Security Program (28 C.F.R. Part 202)

  • NIST SP 800-53 and 800-171

  • CMMC 2.0

  • HIPAA Security Rule

  • NYDFS 23 NYCRR 500

Middle East

  • Saudi NCA ECC and CCC

  • Saudi NCA OSMACC (social media accounts)

  • Saudi NCA CGIoT (IoT)

  • Saudi NCA DCC and OTCC

  • UAE Information Assurance Regulation

  • Dubai Information Security Regulation

Asia-Pacific

  • Australian Essential Eight

  • MAS Technology Risk Management (Singapore)

  • Singapore Cyber Trust mark readiness

Cloud security audit

Reviewing your cloud setup

A read-only review of each account, subscription or tenancy against the CIS Foundations Benchmarks and the framework you answer to — including whether data with residency requirements is hosted where it must be.

Amazon Web Services

Organizations and SCPs, IAM roles and access keys, S3 exposure, Security Hub and GuardDuty coverage, KMS, VPC design and CloudTrail logging.

Microsoft Azure

Management groups and Azure Policy, Entra ID roles and conditional access, Defender for Cloud, Key Vault, storage exposure, network security groups and activity logging.

Oracle Cloud Infrastructure (OCI)

Tenancy and compartment design, IAM policies and dynamic groups, Cloud Guard and Security Zones, NSGs and security lists, Vault, Object Storage exposure and audit logging.

How we deliver

What an engagement can include

Gap assessment

Every control in scope assessed against evidence, not interviews alone, with a status, an owner and a remediation step for each gap.

Control testing

Independent testing that the controls you report actually operate — the internal audit function, or support for it.

Penetration testing

External, internal, web application and cloud testing under written authorization, with exploitable findings evidenced and ranked.

Governance documentation

Policies, standards and procedures written to the framework’s structure, so the evidence trail starts on paper.

Remediation support

Findings that name the configuration or product change to make, with a price range, and a re-test once it is done.

Physical controls

Almost every framework above has physical requirements. We test those too, with the same team.

Physical services

What you receive

A control-by-control register: status, evidence reviewed, owner and next stepper control
Every finding prioritized, with a price rangeno cost · small spend · budget
Cloud findings name the exact setting or policy to changeengineer-ready
An executive summary for the board, your auditor and your regulatorleadership
A re-test once the fixes are inre-test
A fixed fee, agreed in writing before we startquoted up front
No referral fee or commission on any product we recommendpaid by you only
ISO/IEC 27001SOC 2NIST CSF 2.0CISPCI DSS
Scoping

Book a scoping call

A scoping call covers the frameworks that apply, the countries you operate in, the cloud accounts involved, and any deadline you are working to. Engagements run remotely or on site, wherever you are. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.

Request a scoping call

We reply within one business day.

Nothing you send is shared outside Calibre.