A strategy you can re-run is worth more than one you can print.
The platform behind our governance practice. It takes a current-state assessment, a defined target state and a maturity model, and keeps them as live artefacts — so the roadmap on the board pack in March is still the roadmap in September.
Used on our own engagements first. It exists because the alternative was rebuilding the same spreadsheet for every client.
The assessment is finished the day it is delivered.
A maturity assessment arrives as a document. Six weeks later the estate has moved, three findings are closed, one is worse, and nobody can tell you the current score without commissioning the work again.
Point-in-time by construction
Consultancy output is a snapshot. The moment it lands it starts ageing, and the cost of refreshing it is another engagement.
Findings without a baseline
A list of gaps is not a maturity position. Without a consistent model, this year's assessment cannot honestly be compared with last year's.
Roadmaps nobody sequences
Thirty recommendations, all important. Without dependency and effort modelling, the order gets decided by whoever is loudest in the steering meeting.
Compliance reported separately
Maturity lives in one document and regulatory compliance in another, so improving one is never visibly credited to the other.
Current state → target state , with the metrics in between
The whole point is the arrow. A report gives you the two ends and leaves you to draw it.
Assess, define, analyse, track.
The same four steps our consultants run by hand, made repeatable so that the second run costs a fraction of the first.
Assess
Automated current-state assessment against the chosen frameworks, evidence-backed rather than questionnaire-only.
Define
A target state set deliberately — not every organisation should be at level five, and pretending otherwise wastes budget.
Analyse
Rapid maturity analysis produces the gap, weighted by effort, dependency and regulatory pressure.
Track
The roadmap becomes the live artefact. Re-run the assessment and the movement is measured, not asserted.
What comes out of it.
Artefacts for three different audiences, generated from one assessment rather than written three times.
A maturity baseline
A defensible current-state score per domain, with the evidence behind each rating attached, so a challenge to the number has somewhere to go.
A prioritised roadmap
Sequenced by effort, dependency and regulatory deadline — an order you can defend in a steering meeting rather than one assembled in it.
Regulatory compliance metrics
The same estate expressed against whichever framework is being asked about, so one improvement is credited everywhere it counts.
Board-level reporting
Progress against the plan, not a fresh list of findings each quarter. The question a board actually asks is whether last quarter's money moved the number.
Where the roadmap reaches cryptography, it hands over to CADP for the discovery and to QSRAP for the migration plan.
Where it is, honestly.
This one is evolving, and we would rather say so than imply a maturity it has not reached.
Delivered with the engagement
Today it is the platform our consultants run assessments on, not a product you licence and operate yourself.
It does not replace the assessor
The automation removes the mechanical work. Judgement about what a control is actually achieving still comes from a person.
Framework coverage is deliberate
We support the frameworks our clients are held to rather than claiming everything. If yours is missing, ask — adding one is data work, not a rebuild.
Evidence quality sets the ceiling
An assessment is only as good as what it can verify. Where evidence is self-reported, the platform records that it was.
It is not a GRC system of record
It assesses, models and plans. It is not trying to replace a risk register or a policy management system you already run.
A current-state assessment is usually the first conversation.
It produces a maturity baseline and a prioritised roadmap in weeks rather than months, and it tends to settle the argument about where the budget should go next.