Evidence & Risk Assessment
The decision context, scope and evidence register, with sources, dates and limits. Substantiated findings, relevant risks, assumptions and unresolved questions are distinguished, with the strength of support explained.
S/03Commissioned Service
Independent Cybersecurity
Advisory
What should the organisation do, on what evidence, and what still needs to be verified?
A paid, written-first independent cybersecurity advisory commission, delivered as three connected papers: Evidence & Risk Assessment; Options & Decision Analysis; Recommendations & Verification Requirements.
This is a bounded consultancy offering for a defined cybersecurity decision. It moves from examining supplied evidence to comparing possible responses and setting out qualified recommendations. It is not a full-scope audit, and it does not test or implement controls.
The written papers are the primary deliverables. Paid discussions or clarification may be agreed separately, but are optional; a discussion session is not a condition of receiving the papers.
02Client Problem
The problem this addresses
Knowing where evidence is incomplete does not, by itself, settle a decision. Leaders may still need to weigh different responses, their implications and the assumptions on which they depend.
This commission addresses that next question. It makes the reasoning from evidence to options to recommendations explicit, including where uncertainty prevents a firm recommendation.
The flagship report remains the starting offer for understanding critical-service disruption. Independent Assurance Challenge examines existing claims; Assurance Change Review revisits dated findings. This trilogy is distinct: it compares options for a specified decision and gives qualified advice on a course of action. Relevant earlier reports may inform it, but are not required purchases and do not replace examination of the evidence in scope.
03Who Commissions
Who typically commissions it
Described by role. These are not client references.
- Boards and executives considering a defined cybersecurity decision
- Risk owners weighing responses to an evidence-based concern
- Leaders deciding how to address gaps in governance, assurance or service resilience
04Scope
Precise scope
The exact questions and evidence set are agreed in writing before work begins. Within that scope, the work may include the following.
- Agree the decision, questions, evidence sources and exclusions in writing
- Examine what supplied evidence establishes about the risks relevant to that decision, separating supported findings from assumptions and unverified concerns
- Compare a bounded set of options, including retaining current arrangements where relevant, against agreed decision criteria
- Consider trade-offs, dependencies, constraints and the evidence needed to judge feasibility; do not invent costs or benefits where supporting information is absent
- Set out qualified recommendations, alternatives and verification requirements, tracing each to findings and assumptions
- State when the available evidence is insufficient to recommend a course of action
05Client Inputs
What the organisation supplies
Findings can only be as complete as the evidence supplied.
- The decision to be supported, its owner and relevant organisational context
- Documents, risk records, architecture or dependency information relevant to the questions in scope
- Existing assurance, control descriptions and earlier findings, with their sources and dates where available
- Options already under consideration, decision criteria and known operational, financial or governance constraints
- Available evidence about feasibility, resources and costs; missing information is recorded, not assumed
- Written answers to agreed clarification questions; the papers do not require a paid discussion session
06Outputs
What you receive
Three connected written papers form the commissioned deliverable. Their questions, depth and format, together with the fee and terms, are agreed in writing before work begins. All findings and recommendations are limited by the evidence supplied; no fixed length or turnaround is promised.
Options & Decision Analysis
A comparison of the agreed options against decision criteria, showing trade-offs, dependencies and constraints. Each analysis refers back to the first paper and identifies missing evidence or assumptions that could alter the comparison.
Recommendations & Verification Requirements
Qualified recommendations linked to the preceding findings and options. It states the rationale, conditions, alternatives, what further evidence is required and who the organisation should ask to verify it. Where support is insufficient, it records that a recommendation cannot yet be substantiated.
Optional, only where agreed in scope
- — Paid discussion or clarification of the written papers, only by separate agreement. It is not mandatory and does not replace the papers.
07Limitations
What this service does not provide
No penetration testing, vulnerability scanning or live technical testing
No certification of control effectiveness, compliance audit or attestation
No implementation, remediation, incident response or managed service
No vendor or product selling, selection or recommendations
No guarantee of security, resilience, compliance or a particular outcome
No management decisions on behalf of the organisation or ongoing surveillance
08Independence
Independence and recommendations
Independence allows Cyber Analysis to state plainly where evidence supports a claim and where it does not.
Reports may recommend that specific evidence be obtained, that a claim be verified, or that particular questions be put to management or suppliers.
Cyber Analysis does not prescribe vendors or products, implement remediation, make management decisions, or certify compliance or control effectiveness.
Decisions on what to do with the findings remain with the organisation.
09Process
How the work proceeds
- 01
Initial enquiry
Email the decision of concern and the evidence already available. No evidence needs to be sent with the first enquiry.
- 02
Written agreement
Agree the questions, evidence, three-paper deliverable, exclusions, fee and terms before work begins. Scoping can take place by email.
- 03
Evidence examination
Supplied material is examined using the evidence-first methodology. Missing or conflicting information is recorded.
- 04
Options and advice
Options are compared and recommendations qualified by the evidence, assumptions and verification still needed.
- 05
Written delivery
Receive the three papers. Any paid discussion or clarification is optional and separately agreed.
10Contact
Discuss a scoped engagement
Email a short description of the organisation, the claims or changes of concern, and the decision the work is intended to support. Scope is agreed in writing before any work begins.