What it means to be a NOX client.
Clear terms before we start, plain-English findings when we finish, and care with your information throughout.
Clear terms,
plain answers.
Every engagement runs on the same principles, whichever service you choose.
Agreed in writing first
Nothing starts until the scope is signed, and any later change goes through a short written change request, so cost and timing stay clear.
Written in plain English
Every report opens with a one-page summary for the board, then gives your IT team or provider the detail they need to act.
No surprises
Anything under active exploitation is raised the same day, by phone, rather than held back for the report.
An independent view
We assess and advise. Your own team or IT provider makes the changes, and we offer a re-check once they are done.
Documents you can put to work.
Each engagement produces a set of documents that stay useful long after it ends: for your IT provider, your board, and anyone who asks what you have in place.
- 01Turn on multi-factor authentication for email
- 02Keep a copy of backups that cannot be altered
- 03Remove the unused remote access service
Scope and agreement
What is covered, the deliverables, timings, contacts and the terms we work to.
Authorisation
Exactly which systems we may examine, and when.
The report
A summary for the board, then every finding rated, evidenced and given a recommended fix.
A plan with timescales
Critical within 30 days, high within 60, medium within 90, each with a suggested owner.
Records of what you own
Your estate and access records, or the confirmed target list for an exposure check.
A walkthrough
Every finding talked through, and open to challenge.
A re-check
Once you have made the changes, so you can show the issues are closed.
Confirmation of deletion
In writing, at the close of the engagement.
When someone asks
for proof.
Certification bodies, insurers, customers and boards ask similar questions. Our documents are written so you can answer them directly.
Would we pass?
A readiness review checks you against the Cyber Essentials v3.3 controls and shows where you would fall short, before you pay to be assessed. Certification itself is awarded by an accredited certification body.
What do you have in place?
Insurers commonly ask about multi-factor authentication, backups, patching and email security. The report answers with evidence, and a re-check shows what has been fixed since.
How do you manage risk?
Supplier questionnaires and audits ask what you own, who has access, and what you are doing about known weaknesses. Your records and plan answer that directly.
Where do we stand?
A one-page summary in business terms, and a plan with owners and dates to report progress against.
What our reports are, and are not. A record of the systems in scope at the time of the work, on the evidence available to us. They are not a guarantee that those systems are secure, and not a certification.
Treated as a map of your business.
Because that is what it amounts to. This is how we look after it at each stage of an engagement.
Authorised, and no further
- A signed authorisation naming exactly which systems we may examine, and when
- Anything not listed is outside our remit
- Ownership of internet-facing targets verified independently
Exchanged securely
- Documents shared through an end-to-end encrypted service, never as email attachments
- Records encrypted in transit and at rest
- Access read-only wherever possible, and never passwords or keys by questionnaire
Withdrawn and deleted
- Any access you gave us is withdrawn
- Your information is securely deleted at the end of the agreed period
- Written confirmation of what has been deleted
What we need
from you.
Usually no more than a questionnaire and a couple of short calls.
A day-to-day contact
Someone who can answer questions inside the business.
An authorised signatory
Someone able to approve the scope and authorise the work.
The questionnaire
Approximate answers are fine. Never include passwords or keys.
A list of what is in scope
Domains, addresses and systems. We can help you build it.
Access, where agreed
Read-only wherever possible, and withdrawn when we finish.
Your IT provider told
A word in advance, so our activity is not mistaken for an attack.
Arrange a consultation.
Speak to our team about your organisation and where to start. There is no charge and no obligation.