/ Independent cyber risk assurance for boards
Executive confidence in cyber risk.
An independent, evidence-based opinion on how well your cyber risk is governed, and whether your board’s confidence in it is earned.
/ 01 Why it matters
Most boards are confident about cyber risk. Few can show why.
01
Reports measure activity
Dashboards count patches and alerts. They rarely tell the board whether the risks that matter are under control.
02
Insurers check what you declare
Underwriters now test questionnaire answers against external scans. A misstated control is a renewal problem, or a claims problem.
03
Accountability sits with the board
Regulators, acquirers and investors expect directors to evidence their oversight, not simply assert it.
/ 02 What the board believes
MFA is enforced for every administrator.
We can recover our core systems.
Our cyber report to the board is green.
What the evidence shows
14 supplier admin accounts have no MFA.
The most critical service has never been restored in a test.
The top risk on the register has no treatment plan.
Illustrative findings from a fictional client. The distance between the two columns is the assurance gap.
Confidence should rest on evidence, not on assumption.
/ 03 Independent by design
We assess and report. Nothing else.
Our opinion is only worth something if nothing depends on it. We never implement, remediate or resell, and our fees are fixed before we see a single document.
An independent opinion / Not a compliance certificate
Governance and evidence / Not a penetration test
Written for the board / Not a technical audit
Fixed fees / Never linked to findings
/ 04 Stonegate Avereth™
Three questions every board should be able to answer.
Each service carries its own rating. We never blend them into one score.
AVERETH EXPOSURE
What are our most significant cyber risks, and how well are they managed?
Our entry assessment: seven domains, from governance to trend monitoring, each rated with a stated confidence.
AVERETH NEXUS
Which suppliers and dependencies create material cyber risk?
Third-party and supply chain assurance for organisations that rely on managed service providers and critical suppliers.
AVERETH RESILIENCE
If a serious incident happened tomorrow, how confident should we be?
Incident readiness and recovery, judged on what has been tested and proven, not on what the plan says.
Know where you stand before your insurer, regulator or acquirer asks.
Book an executive consultation
/ 05 How an assessment works
Three to six weeks, from scope to board.
01
Scope
What is assessed, who we speak to, and the evidence cut-off.
02
Evidence
A tailored request list, a secure portal, and leadership interviews.
03
Assessment
Evidence graded by reliability, verified independently where it matters.
04
Your response
You respond to every preliminary finding before anything is final.
05
Opinion
Final reports and a board session, then quarterly assurance if you choose.
/ 06 What the board receives
A clear rating, and how far you can rely on it.
Every domain is rated on a five-point scale, with confidence stated separately. Withheld evidence means no overall rating, so the headline can never look better than the facts.
5 Assured
4 Managed
3 Developing
2 Weak
1 Critical
Overall rating
2 Weak
Confidence ●●○○ Medium
Governance & Accountability
3 Developing
Risk Identification
3 Developing
Risk Visibility & Executive Awareness
4 Managed
Control Assurance & Confidence
1 Critical
Risk Prioritisation & Decision-Making
2 Weak
Business Impact & Risk Quantification
3 Developing
Exposure Monitoring & Trend Analysis
5 Assured
Illustrative ratings for a fictional client
/ 07 Insights
For the boardroom.
Insurance
Your insurance questionnaire is now a test, not a form
Suppliers
When your IT provider holds the keys
Governance