Discover
Establish the operational contextIdentify critical services, material risks, dependencies and the outcomes leadership needs the assessment to prove.
ResnSec360 assessment platform
Assessment evidence your board can act on.
ResnSec360 runs 22 assessments across cybersecurity, resilience, governance, and emerging technology. One six-phase method, from scoping and evidence collection through control testing to executive reporting.
Aligned with NIST CSF 2.0, ISO 27001, CIS Controls, and Zero Trust architecture principles.
02 / 05
Core Cybersecurity
Security baseline and control assurance.The portfolio in numbers
22
Assessments
Across the full resilience lifecycle.
4
Categories
From core cybersecurity to emerging technology.
6
Phases
In every engagement, scoping to reporting.
7
Deliverables
Board-ready, in every assessment.
5
Maturity levels
One scale across the whole portfolio.
The assurance gap
Point tools find issues. An assessment proves resilience.
Scanners and dashboards surface individual weaknesses. A structured assessment connects them: evidence is collected, controls are tested, findings are validated with their owners, and the result is a maturity picture the board can defend.
Control assurance
Controls tested for design and operating effectiveness, not just documented.
Recovery readiness
Continuity, recovery, and crisis capability validated through evidence and exercises.
Board governance
Findings translated into owned actions, maturity targets, and board-level reporting.
The portfolio
Four categories, one maturity journey
The portfolio follows a practical sequence: establish control assurance, validate continuity and recovery, strengthen governance and compliance, then address emerging technology risk.
Security baseline and control assurance.
Checks whether the organization has the basic cybersecurity and IT control foundation needed to protect systems, users, data, and networks.
- NIST CSF 2.0 Creates a structured view of cyber risk management capability using a…
- Cybersecurity Maturity Assesses how mature the organization is across governance, asset mana…
- Zero Trust Determines whether the organization verifies every user, device, appl…
- Vulnerability Assessment Identifies technical weaknesses in systems, applications, networks, e…
- Penetration Testing Simulates controlled attack scenarios to validate whether vulnerabili…
Business survival, recovery readiness, and operational resilience.
Checks whether the business can continue operating and recover critical services during disruption, outage, cyberattack, disaster, or crisis.
- ITCA Determines whether the IT control environment is properly designed, i…
- BCDR Determines whether critical business operations and technology servic…
- Business Impact Analysis Defines what must be recovered first, how quickly, and what resources…
- Cyber Resilience Assesses whether the organization can withstand, respond to, and reco…
- Incident Response Determines whether the organization can detect, contain, investigate,…
- Crisis Management Determines whether the organization can lead, decide, and communicate…
- Continuity & Recovery Strategy Determines whether recovery strategies match the recovery priorities …
- Plan Development Determines whether continuity, recovery, and response plans are compl…
- Testing, Exercises & Validation Determines whether continuity and recovery capability has been proven…
Accountability, oversight, compliance evidence, and risk-informed decisions.
Checks whether technology and cyber risks are properly owned, measured, reported, governed, and aligned with regulations, contracts, and business risk appetite.
- IT Risk Creates a risk register with likelihood, impact, existing controls, r…
- Third-Party Risk (TPRM) Assesses risk introduced by suppliers, outsourced providers, technolo…
- Regulatory Compliance Determines whether the organization can demonstrate compliance and cl…
- Data Privacy / DPIA Identifies privacy risks in systems, processes, projects, or data-dri…
Future readiness and controlled innovation.
Checks whether new technologies such as AI, GenAI, IoT, and OT are adopted safely, securely, ethically, and under proper governance.
- AI Risk Identifies broad business, operational, legal, ethical, privacy, and …
- AI Security Assesses how AI systems can be attacked, misused, manipulated, or use…
- GenAI Readiness Determines whether the organization is ready to safely use generative…
- IoT / OT Security Assesses cyber and operational risk in connected physical, industrial…
How every assessment runs
-
Phase 1 of 6
Scope and Planning
Activity
Confirm business units, systems, locations, vendors, assessment objectives, stakeholders, and success criteria.
Output
Approved scope, stakeholder list, assessment plan, and document request list.
-
Phase 2 of 6
Evidence Collection
Activity
Review policies, procedures, system configurations, audit logs, architecture diagrams, contracts, recovery plans, and prior audit findings.
Output
Evidence inventory and initial control observations.
-
Phase 3 of 6
Interviews and Workshops
Activity
Conduct interviews with IT, security, risk, compliance, business continuity, legal, procurement, and business process owners.
Output
Validated process understanding, control ownership, and dependency mapping.
-
Phase 4 of 6
Control and Maturity Testing
Activity
Evaluate design effectiveness, operating effectiveness, maturity level, risk exposure, and control gaps.
Output
Assessment results, maturity ratings, and risk-ranked findings.
-
Phase 5 of 6
Validation
Activity
Discuss findings with control owners to confirm accuracy, context, root cause, and remediation feasibility.
Output
Management-validated findings and agreed action owners.
-
Phase 6 of 6
Executive Reporting
Activity
Prepare a board-level summary, heatmap, roadmap, risk themes, and priority decisions.
Output
Final board report, action plan, and implementation roadmap.
The continuous assurance loop
From detection to verified recovery—continuously.
ResnSec360 connects discovery, evidence, control testing, remediation priorities and executive assurance through one defensible assessment process.Scope
Focus assurance where it mattersTranslate business priorities into clear boundaries, stakeholders, systems, control objectives and evidence requirements.
Evidence
Build a traceable body of proofCollect policies, configurations, records and interviews once, then map every artefact to the controls it supports.
Test
Verify design and operationChallenge whether controls are appropriately designed, consistently performed and effective against the stated risk.
Prioritize
Turn findings into owned actionRank validated gaps by business impact and effort, with accountable owners, target dates and measurable outcomes.
Assure
Give the board a defensible viewConfirm progress, refresh maturity, preserve the evidence trail and report whether resilience is improving over time.
Assurance feeds the next assessment cycle—keeping evidence, priorities and board oversight current as risks change.
An engagement in action
From first call to board pack
-
Step 1: Scoping call
Objectives, stakeholders, and systems agreed up front, with a document request list so nothing is collected twice.
-
Step 2: Evidence and interviews
Policies, configurations, and logs reviewed; process owners interviewed; dependencies mapped.
-
Step 3: Testing and validation
Controls tested for design and operation; every finding confirmed with the people who own it.
-
Step 4: Board pack
Maturity scorecard, risk heatmap, remediation roadmap, and an action plan with owners and dates.
How maturity is scored
- 1 Initial / Ad Hoc
- Controls are informal, inconsistent, undocumented, or dependent on individual effort.
- 2 Developing
- Some controls exist, but coverage, ownership, testing, or evidence is incomplete.
- 3 Defined
- Controls are documented, assigned, and implemented across most relevant areas.
- 4 Managed
- Controls are monitored, tested, measured, and supported by regular reporting.
- 5 Optimized
- Controls are continuously improved, automated where practical, and aligned with risk appetite and business resilience objectives.
What every assessment delivers
| Deliverable | Purpose |
|---|---|
| Executive Summary | Board-level view of current state, major risks, priority actions, and decisions required. |
| Assessment Report | Detailed findings, evidence reviewed, control gaps, maturity scores, and observations. |
| Risk Heatmap | Visual prioritization of high, medium, and low risks by likelihood and impact. |
| Maturity Scorecard | Capability rating by domain, category, or control area. |
| Remediation Roadmap | Prioritized action plan with owners, timelines, dependencies, and expected risk reduction. |
| Management Action Plan | Agreed corrective actions, accountable owners, target dates, and a tracking mechanism. |
| Board Dashboard | Concise metrics for ongoing oversight, trend monitoring, and investment decisions. |
Framework alignment
- NIST CSF 2.0
- ISO 27001
- CIS Controls
- PCI DSS
- GDPR
- Zero Trust architecture principles
Where clients typically begin
Every engagement is scoped to your context. When clients ask where to start, this is the sequence we most often recommend.
-
1
ITCA (IT Controls Assessment)
Establishes the IT control baseline.
-
2
BCDR Assessment
Confirms business continuity and technology recovery readiness.
-
3
Business Impact Analysis
Defines critical services, dependencies, RTO, and RPO.
-
4
Cyber Resilience Assessment
Connects cyberattack scenarios with business recovery capability.
-
5
NIST CSF 2.0 and Cybersecurity Maturity
Provide recognized cyber maturity scoring and executive reporting.
-
6
Zero Trust Assessment
Strengthens identity, access, segmentation, and continuous verification.
-
7
IT Risk and Third-Party Risk
Translate technical and supplier gaps into business risk and accountability.
-
8
AI Risk, AI Security, and GenAI Readiness
Control modern AI adoption risks before they become unmanaged exposure.
Could you evidence your resilience to the board tomorrow?
A scoping conversation is the fastest way to find out. Tell us your organisation, your role, and the assessments you are considering; we will come back with a proposed scope, stakeholder list, and document request list.