A cybersecurity (IT security) audit helps you understand which controls you actually have in place, where they are not working well enough and which weaknesses pose the greatest risk. Before work starts, we define the scope of the audit and the assessment criteria. We then review the evidence and prepare an action plan that your management and technical team can use.
An audit does not follow a generic checklist. First we agree which systems, assets and processes matter and which criteria we will assess them against. Depending on the scope, we draw on configurations, documents, system data, interviews and other verifiable evidence. This lets us distinguish a control that is documented on paper from one that actually works in your environment.
We can review the security configuration of servers, networks, cloud environments and applications, along with patch and vulnerability management, public-facing services, encryption, logging, backups and other agreed technical controls.
We assess identity and privilege management, including administrator and user accounts, multi-factor authentication, how access is granted and revoked, access held by external suppliers and other risks linked to who is permitted to reach important systems and data.
We review the agreed security processes, such as patch and vulnerability management, backup checks, how logs are used, incident escalation and who is responsible for what. A documented policy is not, on its own, proof that a control works in practice.
If it falls within the scope of work, we can map the audit criteria to a specific security framework or to the technical and organisational requirements that apply to you. We do not treat a general technical audit as the basis for a legal or certification opinion on compliance with NIS2, Latvian regulatory requirements, the GDPR or ISO 27001. An opinion of that kind requires a separately scoped compliance assessment and the relevant expertise.
An audit mainly assesses controls, configuration, processes and evidence within a defined scope. A penetration test actively looks for exploitable vulnerabilities in a specific technical target and, where permitted, validates them. An audit can include technical checks, but that does not automatically make it a penetration test. We choose the method according to the question you need answered.
We agree the objective of the audit, the systems, assets and processes it covers, the assessment criteria, the access we need and the points of contact. Before work starts, you get a clear scope, a list of deliverables, a timeline and a price.
We review the agreed controls and document the evidence. Each finding states clearly what we observed, why it creates a risk and what the conclusion is based on.
We prioritise the findings by potential impact, exploitability or likelihood, the importance of the affected assets and the context of your environment. We set out the recommended actions so that your technical team and management have a sound basis for planning the work and resources.
We present the main conclusions, explain the risk priorities and talk through the order of remediation with your technical team and management. If needed, we also agree a retest of specific findings once the fixes have been made.
Find out what your security controls really cover
Tell us briefly about your environment and the objective of the audit. We will reply within one working day and let you know what we need to prepare the scope and the proposal.
The value of a report is not in how many findings it lists. It has to help you understand which risks need immediate action, which should go into your next plan of technical work and where further investigation or a different type of security assessment is needed. We write the recommendations so that your team or another supplier of your choice can work from them.
If needed, we can help you refine the remediation approach, and we can retest the specific findings once the fixes have been made. A retest confirms the state of the tested finding at that point in time, not the security of the whole environment in the future.
If it is within scope, we map the audit criteria to ISO/IEC 27001 controls or NIS2 requirements and show where the gaps are. The audit helps you prepare, but ISO/IEC 27001 certification is issued by an accredited certification body.