Cybersecurity readiness support
Turn cybersecurity requirements into practical actions.
Assess your controls, organise your evidence and prepare for customer, insurer and Essential Eight requirements.
Fixed quote based on the requirement, evidence and systems included.
Service selector
Start with the requirement in front of you.
Different situations need different evidence and deliverables. Choose the service that most closely matches your current business need.
| Your situation | Recommended service | Primary outcome |
|---|---|---|
| We do not know where our main risks are. | Cyber Risk Health Check | A prioritised business risk roadmap |
| A contract mentions the Essential Eight. | Essential Eight Readiness Assessment | Framework aligned readiness observations |
| Our cyber insurance renewal is approaching. | Cyber Insurance Readiness Review | Evidence supported questionnaire preparation |
| We need a usable response plan. | Incident Response Planning Workshop | Roles, checklists and scenario playbooks |
| A customer sent us a security questionnaire. | Supplier Questionnaire Readiness Review | Supported answers and a remediation list |
| Our security policies are incomplete or outdated. | Security Policy Foundation Pack | Practical policies with clear ownership |
Assess, prepare and maintain
A practical pathway from uncertainty to ongoing readiness.
Understand your current position
- Cyber Risk Health Check
- Essential Eight Readiness Assessment
- Cyber Insurance Readiness Review
Identify risks, evidence gaps and priorities before choosing implementation work.
Create usable evidence and plans
- Incident Response Planning Workshop
- Supplier Questionnaire Readiness Review
- Security Policy Foundation Pack
Turn requirements into documented responsibilities, supported answers and practical actions.
Keep controls and evidence current
- Cyber Protect
- Annual policy reviews
- Tabletop exercises
- Quarterly security reporting
Review changes, track remediation and prevent readiness materials from becoming outdated.
Fixed-scope option
Supplier Questionnaire Readiness Review.
Prepare accurate, evidence supported responses when a customer, enterprise partner or procurement team asks detailed security questions.
Questionnaire review
Clarify technical questions, scope and response dependencies.
Evidence checklist
Record available evidence and items still needing confirmation.
Unsupported answer register
Identify answers that appear incomplete, ambiguous or unsupported.
Remediation priorities
Set out practical improvements based on urgency and business impact.
Clarification questions
List requirements that should be confirmed with the requesting organisation.
Findings meeting
Review the evidence, open questions and recommended next steps.
Fixed-scope option
Security Policy Foundation Pack.
Create practical baseline policies that reflect how your organisation actually works, with clear ownership and review expectations.
Information security policy
Define the organisation’s security principles, responsibilities and governance approach.
Acceptable use policy
Set expectations for appropriate use of business technology and information.
Access control policy
Document account, privilege, approval and access review responsibilities.
Remote working policy
Set practical expectations for devices, access, information and working locations.
Incident responsibilities
Define initial reporting, escalation and ownership expectations.
Review schedule
Assign policy owners and define when documents should be reviewed or updated.
Engagement process
From external requirement to practical next steps.
Share the requirement
Provide the framework, questionnaire, contract request or documentation need.
Confirm scope
Agree the systems, evidence, stakeholders, deliverables, exclusions and deadline.
Review
Examine the agreed controls, documents and available supporting evidence.
Identify gaps
Record unsupported claims, missing documents and practical security improvements.
Deliver
Provide the agreed readiness materials, recommendations and findings review.
Maintain
Choose how remediation, reviews and recurring readiness will be managed.
Commercial approach
A fixed quote based on the requirement.
Pricing depends on the framework, questionnaire, systems, evidence, documents and deadline involved.
Your proposal confirms:
- Requirements and systems included
- Evidence and stakeholder responsibilities
- Documents and deliverables supplied
- Expected schedule and findings review
- Exclusions and separate implementation work
- The fixed price for the agreed scope
Responsibilities
Readiness support works alongside qualified advisers.
| Need | Appropriate role |
|---|---|
| Technical readiness and cybersecurity evidence | CyberCrunch and your technology providers |
| Legal and regulatory interpretation | An appropriately qualified legal adviser |
| Insurance policy questions | Your broker or insurer |
| Formal certification or independent assurance | An appropriately accredited auditor or assessor |
| Privacy law advice | A qualified privacy or legal adviser |
| Penetration testing | A suitably qualified specialist under a separate scope |
Who it’s for
Useful when cybersecurity evidence affects a business decision.
Customer questionnaires
Prepare accurate responses and identify evidence gaps before submission.
Tenders and procurement
Understand security requirements and organise practical supporting material.
Insurance renewals
Review technical questions and current evidence before the deadline.
Essential Eight requirements
Assess readiness where a contract or customer references the framework.
Policy development
Create foundational documents with clear ownership and review schedules.
Multiple IT suppliers
Coordinate evidence and responsibilities that span several external providers.
Frequently asked questions
What to know before requesting support.
Does CyberCrunch certify compliance?
No. We provide readiness, documentation and implementation support. Formal certification or independent assurance requires an appropriately qualified assessor under a clearly defined engagement.
Can you tell us which laws apply?
No. Legal and regulatory interpretation should come from an appropriately qualified legal or privacy adviser. We can help translate agreed cybersecurity requirements into practical controls and evidence.
Can you complete security questionnaires for us?
We can review technical questions, evidence and gaps. Your organisation remains responsible for approving and submitting accurate answers.
What evidence will we need?
Evidence depends on the requirement and scope. It may include configurations, system records, policies, procedures, test results and information from technology providers.
Can our existing IT provider participate?
Yes. Their involvement can help confirm controls, gather evidence and plan remediation.
Is technical remediation included?
No, unless it is explicitly included in the written scope. Additional implementation work is agreed and quoted before it begins.
How are policies kept current?
Policy owners and review schedules should be assigned. CyberCrunch can also provide periodic review support through a separate engagement.
What happens if several frameworks apply?
We first identify the specific requirements and overlaps, then propose a scope that avoids unnecessary duplication. Legal interpretation and formal certification remain outside the service unless explicitly provided by qualified specialists.
Can you work to a tender deadline?
Potentially, depending on availability, scope and evidence readiness. The expected delivery schedule is confirmed before work begins.
Ongoing readiness
Keep controls, evidence and policies current with Cyber Protect.
Initial readiness work identifies and organises the current position. Cyber Protect can support recurring security reviews, policy scheduling, backup checks, awareness activities, remediation tracking and quarterly reporting.
Start with the requirement
Choose the right cybersecurity readiness service.
Tell us what a customer, insurer, contract or internal stakeholder has requested. We will confirm the appropriate service, defined scope and fixed quote.