Who this service is for
For organisations seeking a common language for cyber risk, clearer investment decisions and measurable improvement across their security programme.
NIST CSF 2.0
Build a practical cyber security improvement programme around business priorities, current capabilities and a clear target profile.
Common challenges companies face
- Security investments are driven by individual tools rather than business risks.
- Asset, supplier and service inventories do not agree, leaving assessment boundaries unclear.
- Policies describe intended controls, while operational evidence is incomplete or outdated.
- Leadership receives activity counts without a clear view of risk reduction or accountable owners.
Technical scope
- Define business context, scope and current and target organisational profiles.
- Review outcomes across Govern, Identify, Protect, Detect, Respond and Recover.
- Examine identity lifecycle, privileged access, asset management, vulnerability handling, monitoring and recovery evidence.
- Map existing controls to relevant outcomes, recording partial coverage and gaps rather than assuming equivalence.
How Poleis supports you
- Agree assessment boundaries and stakeholders, then review documents and interview control owners.
- Validate selected claims against operational records and representative samples.
- Prioritise gaps by risk, dependencies and effort, and agree ownership and review milestones.
What you receive
- Current and target profile with documented assumptions and evidence references.
- Prioritised improvement roadmap with accountable owners and dependencies.
- Executive risk summary and practical measures for tracking progress.
Engagement scope
CSF is a framework for managing cyber risk. A completed profile is not a certification, and an informative mapping does not establish that a control is effective.
Discuss Your Requirements
Tell us about your organisation, the assessment or improvement you need, and your timescale. We will agree a proportionate scope and practical next steps.