1) Assessment & Audit
- Risk assessment of networks, endpoints, cloud accounts, and data flows.
- Security posture review (policies, access controls, backups, logging).
- Vulnerability scanning and (optionally) penetration testing.
- Compliance gap check against industry best practices and applicable regulations.
- Deliverables: findings, prioritized risk register, remediation roadmap.