Assessments

A controls assessment against NIST SP 800-53 Rev. 5 — the highly detailed, prescriptive catalogue of security and privacy controls required for US federal agencies, government contractors and regulated industries under FISMA and FedRAMP. Organised by the 20 control families, with controls tailored to your system impact level (Low / Moderate / High). Best suited to public-sector organisations, government contractors, or mature enterprises wanting an exhaustive technical checklist. Pre-filled from your onboarding data where possible.

A business-driven security assessment against the ISF Standard of Good Practice (SoGP) — a pragmatic, frequently updated framework developed by the Information Security Forum for commercial enterprises. It bridges ISO 27001’s high-level governance and NIST’s prescriptive detail, focusing on real-world risks like cloud, supply chain and mobile, aligned to business objectives rather than legal compliance. Best suited to large commercial and multinational organisations that want a comprehensive, adaptable baseline. Pre-filled from your onboarding data where possible.

A risk-driven readiness assessment against the ISO/IEC 27001:2022 standard — the globally recognised, certification-ready framework for building an Information Security Management System (ISMS). Covers the management clauses (4-10) and all four Annex A control themes: Organizational, People, Physical and Technological. Best suited to organisations of any size that need an internationally recognised badge of trust for customers, partners and regulators. Pre-filled from your onboarding data where possible.

A comprehensive cyber risk assessment based on the Comprehensive Cyber Risk Assessment questionnaire and the SHA Cyber Minimum Security Requirements. Structured on the ISO/IEC 27002 information-security controls and pre-filled from your onboarding data. Covers governance, access management, operations security, incident response, business continuity, privacy compliance, and the minimum controls that are a condition precedent to cyber insurance cover.

A comprehensive POPIA compliance assessment for security systems — CCTV, access control, visitor management, facial recognition, and alarm systems. Covers governance, lawful basis, data minimisation, retention, security safeguards, and third-party operator compliance under the Protection of Personal Information Act.

Based on the Draft Gated Access Code of Conduct published 30 April 2026. This compliance scorecard targets the "security-first, privacy-later" culture of South African gated estates. Covers visitor entry protocols, facial recognition (FRT), biometrics, layered signage notices, data retention, and guarding firm operator compliance.

A detailed POPIA assessment for biometric operators — providers of facial recognition, visitor management, or other biometric processing platforms. Covers Section 19-22 obligations, technical integrity, incident response, AI fairness, and data subject rights.

A comprehensive audit of your website's POPIA and PAIA compliance. The Information Regulator is actively using web crawlers to audit company websites. This assessment checks statutory documents, Information Officer visibility, consent mechanisms, statutory forms, and technical security.

A comprehensive technical and legal assessment that evaluates the lawfulness, proportionality, and safeguards of surveillance and biometric processing systems under POPIA. Covers governance, necessity testing, biometric technicalities, security safeguards, data retention, and subject rights.

Detailed questionnaire about POPIA compliance of physical security systems including data collection, sharing, linking, hosting and security measures.