Many systems, one scale.
A broader assessment across multiple systems, shared services or an entire estate, with risk normalised so exposure can be compared and ranked across the whole.
Across an estate, the ranking is the deliverable. The top of this list is where the next dollar goes.
What triggers this engagement.
You need to know where the worst exposure sits across several systems, and answers scored by different people at different times are not comparable.
Where the boundary sits.
A scope that is not written down is a scope that grows. Ours is agreed before work starts and it is printed in the report.
- Every system in the agreed boundary, scored on one scale
- Shared services and the dependencies between systems
- Concentration risk where several systems rest on one provider
- An aggregate view alongside the system-level detail
- Systems outside the agreed boundary, named explicitly in the report
- Exploitation in practice
- Vendor negotiation, though the findings support it
- A working list of systems in the boundary, however rough
- Access to system owners across the estate
- Whatever documentation exists, gaps included
Longer than a single system, and scheduled together during scoping once the boundary is agreed.
What you receive.
One document, layered so that a board and an engineering team can both work from it.
Is this the right scope for you?
Tell us the decision you are facing. If a different engagement fits better, we will say so before you commit to this one.