Governance and controls: risk-based control testing against defined ISO 27001/27002, ISO 22301, ISO 27701 and other applicable reference requirements.
← View all solutions
Security technology · Engineering · Security assessments
Your audit should give you a decision, not another list of abstract gaps.
Whether you are assessing an internal control programme, a supplier or a critical platform, we examine how your documented controls operate in practice.
Engineering, evidence and operational results
See the work behind the offer
Follow a realistic engineering situation, from the first signal to the decision and the evidence handed over.
DEEP INFOSEC
What this means for your organisation
Whether you are assessing an internal control programme, a supplier or a critical platform, we examine how your documented controls operate in practice. Our auditors connect interviews, configuration evidence and observed processes to the risks and standards relevant to your organisation.
The output sets out tested controls, supporting evidence, accountable owners and an actionable remediation plan. PASC and ISO-related professional qualifications are presented within their applicable scopes, with detailed supporting materials available through your agreed procurement channel.
A practical starting point
Choose a starting scope, review the evidence and prepare a usable purchasing brief. Public service information is open to everyone; confidential architecture and qualification materials follow the secure dossier process.
Prepare a project brief ↗Selected readings ↗The challenges we solve
Specialist workstreams
ISO-certified auditors deliver evidence-led security and control assessments, with PASC and OSPCRM scope documented for procurement.
Technology and supplier assurance: identity, cloud, change management, logging, backup, vendor and software supply-chain review with evidence sampling.
PASC / OSPCRM assessments: map agreed control and risk-scoring requirements to a repeatable testing plan and accountable corrective action.
Audit remediation support: document findings, impact, control owners, evidence gaps, management responses, remediation and follow-up testing without confusing advisory work with independent certification.
What your team receives
What your team receives
- Audit charter, criteria, independence and sample-selection plan
- Evidence-to-control matrix and reproducible working papers
- Risk-ranked findings and corrective action register
- Executive assurance report and management response tracking
Defined entry offers
Acceptance is tied to the agreed deliverables and documented review.
01
Technical assessment
Governance and controls: risk-based control testing against defined ISO 27001/27002, ISO 22301, ISO 27701 and other applicable reference requirements.
Audit charter, criteria, independence and sample-selection planRequest a technical and commercial proposal ↗02
Design and controlled evaluation
Technology and supplier assurance: identity, cloud, change management, logging, backup, vendor and software supply-chain review with evidence sampling.
Evidence-to-control matrix and reproducible working papersRequest a technical and commercial proposal ↗03
Delivery, review & continuity
Audit remediation support: document findings, impact, control owners, evidence gaps, management responses, remediation and follow-up testing without confusing advisory work with independent certification.
Executive assurance report and management response trackingRequest a technical and commercial proposal ↗Scope & architecture
How a project progresses
Internal audit support, external independent assessment or ongoing controls assurance; issuer, accredited entity and certification boundaries appear in the confidential assignment dossier.
- 01
Discover and define: assets, objectives, dependencies, data access, stakeholders and boundaries.
- 02
Design and validate: target architecture, methods, constraints, workplan and objective acceptance criteria.
- 03
Deliver and transfer: approved implementation, findings, tests, documentation, training and next-stage options.
Request a technical and commercial proposal
Agree the legal entity, audit criteria, scope, independence model and source evidence with the lead ISO-qualified auditor.
Engineering and services that work together
What changes for your organization
Where this matters
An audit is valuable when its conclusions can be traced from a business requirement to a control, an observed fact and an accountable action. Our ISO-qualified auditors structure evidence sampling, assess the design and operation of controls, and provide findings that management can prioritize. Applicable PASC/OSPCRM assessment scopes are identified for the engagement, with clear separation between advice and independent assurance.
Solutions for your role
Begin with your decisions, risks and procurement obligations—not a generic product catalogue.
PASC · OSPCRM · ATTACK PATHS
Attack-path risk management and professional assurance
Our security assessment, penetration-testing, CISO and disaster-recovery work uses defined technical criteria and repeatable evidence. OSPCRM connects weaknesses, identities, access paths and critical services to model plausible attack sequences and compare the controls that reduce exposure. Its predictive method helps teams examine how risk may change as architectures, privileges or threats change.
OSPCRM
OSPCRM certification eligibility begins with demonstrable, effectively implemented ISO-level management practices. PASC then conducts its own assessment of the applicant’s methods, controls and evidence.
PASC / ONPC-RDC
Deep InfoSec supports risk management, CISO advisory, disaster recovery, audits and penetration testing under the agreed PASC/OSPCRM scope. For an external independent assessment, the assessment is entrusted to a separate PASC-conformant entity; the DRC institutional route involves ONPC-RDC. The performing and reviewing organizations are identified in the engagement.
Security testing is part of how we build and maintain our products
Deep InfoSec performs daily automated security scanning, annual penetration tests of its solutions, recurring security assessments combining human analysis with AI, and ongoing adversarial exercises intended to break assumptions before attackers exploit them. We use the findings to correct code, configuration, authentication, dependencies and operational controls, then verify the fixes in the affected environment.
Deep Advisor explores attack-path hypotheses beyond known single-vulnerability patterns. It evaluates combinations of reachability, privileges and exposed services, proposes mitigations linked to each path, and helps analysts reduce the set of viable paths open to an attacker. These insights inform technical remediation and its verification.
Review the assessment methods ↗