Choose an assessment around the decision you need

Start with the decision

An assessment should help answer a business question. Do you need to prioritise a security programme, understand weaknesses in specific assets or review evidence supporting controls? Those questions suggest different scopes. ## Security consulting A consulting engagement can consider the broader security posture, governance and improvement priorities. Its deliverables may include a risk register and roadmap rather than exploitation evidence. ## VAPT VAPT focuses on authorised technical assessment of agreed assets. Targets, permissions, methods and exclusions are defined before testing. The report should connect findings with remediation responsibilities. ## IS audit and ITGC review These engagements review agreed control objectives and evidence. The focus can include access, changes and operations, with findings related to the business systems in scope. ## Combine carefully Workstreams can be coordinated, but their responsibilities and deliverables should remain clear. A technical test is not automatically a complete governance review, and a policy review does not demonstrate that an application has no exploitable weakness. ## Next step Describe the decision you need to make during consultation. We can then discuss the relevant workstreams and propose a clear scope.