Protego

How we work

A sequence, not a retainer with no end state.

The same five stages run every engagement, whether it ends in a certificate or a deployed system. It is how a firm our size delivers to a consistent standard, and how you know what you are getting before you sign.

01

Assess

We map your systems, data flows, suppliers and obligations, then test them against the standard you are being held to. No recommendations until we understand the ground.

Deliverables

  • Current state assessment
  • Obligations map
  • Prioritised gap register
  • Scoping decisions recorded with rationale

02

Design

The target state, specified so an engineer can build it and an auditor can check it. Controls, architecture, ownership and the plan to get there.

Deliverables

  • Control design and Statement of Applicability
  • Target architecture
  • Policy set
  • Remediation plan with owners and dates

03

Build

We work alongside your engineers to close gaps. Controls implemented and documented, code and infrastructure changed, evidence produced as a by-product of the work.

Deliverables

  • Implemented controls with evidence
  • Technical changes delivered
  • Runbooks
  • Training for the people who will operate it

04

Certify

We prepare the evidence pack, run internal audit and management review, and support you through the audit itself.

Deliverables

  • Evidence pack
  • Internal audit report
  • Management review minutes
  • Auditor liaison
  • Nonconformity closure

05

Operate

Fixed cadence assurance so the standard holds between audits.

Deliverables

  • Access reviews
  • Vulnerability management
  • Risk register upkeep
  • Quarterly reporting
  • Surveillance audit support

Working with Protego

What you can expect from us

  1. 01A named lead who does the work and stays for the engagement.
  2. 02Fixed fees agreed before we start. No change requests for things we should have scoped.
  3. 03Plain reporting. If something is going badly you will hear it from us first.
  4. 04Everything we produce is yours, in editable form, including the working files.

Next step

Start with a conversation, not a proposal.

Thirty minutes. We will tell you what we would do, what it would take, and whether we are the right firm for it.

Book an assessment callDownload our capability statement