The right expert for the question in front of you.
Filter our 35 service lines by practice, service and industry. Every team is led by senior practitioners, and every conversation is confidential.
Search our expertise.
Choose a practice, a service line or your industry, or describe the problem in a few words. Each result shows what the team covers and the questions clients bring to it.
-
Financial Services Payment Security
PCI DSS Assessments (ROC & SAQ)
What the team coversScoping the cardholder data environment, segmentation, the PCI DSS v4.0.1 requirements and evidence organized the way your assessor reads it, whether you file a Report on Compliance or a Self-Assessment Questionnaire.
Questions we are asked- Which systems are really in scope, and can segmentation shrink that list?
- Are we ready for the future-dated v4.0.1 requirements?
- Do we need a Report on Compliance or a Self-Assessment Questionnaire?
Industries we see most- FinTech & Payments
- Retail & E-Commerce
- Banking & Financial Services
- Technology & SaaS
-
Financial Services Payment Security
PCI DSS Gap & Readiness
What the team coversA requirement-by-requirement gap assessment and a remediation plan that closes findings before the formal assessment begins.
Questions we are asked- Where would we fail if the assessor arrived next month?
- Which gaps should we fix first, and who owns them?
Industries we see most- FinTech & Payments
- Retail & E-Commerce
- Banking & Financial Services
- Technology & SaaS
-
Financial Services Payment Security
Point-to-Point Encryption (P2PE)
What the team coversPoint-to-point encryption programs: solution selection, device handling, chain of custody and the scope reduction a validated solution can bring.
Questions we are asked- Will a P2PE solution reduce our PCI DSS scope?
- Are our device inventory and chain-of-custody controls strong enough?
Industries we see most- Retail & E-Commerce
- FinTech & Payments
-
Financial Services Payment Security
PCI PIN Security
What the team coversPIN security across key management, hardware security modules and PIN-acceptance devices, from entry to authorization.
Questions we are asked- Do our key ceremonies meet the PCI PIN requirements?
- How should we evidence HSM and key-custodian controls?
Industries we see most- Banking & Financial Services
- FinTech & Payments
-
Financial Services Payment Security
PCI 3-D Secure (3DS)
What the team coversThe 3-D Secure environment: access control servers, directory servers and the controls that protect cardholder authentication.
Questions we are asked- Which of our components fall under the PCI 3DS standard?
- How do we separate 3DS data from the rest of the estate?
Industries we see most- FinTech & Payments
- Banking & Financial Services
- Retail & E-Commerce
-
Financial Services Payment Security
PCI Software Security Framework (SSF)
What the team coversSecure software lifecycle practices and payment software design under the PCI Software Security Framework.
Questions we are asked- Is our development lifecycle ready for Secure SLC validation?
- What evidence will a software assessor expect from our engineers?
Industries we see most- FinTech & Payments
- Technology & SaaS
-
Financial Services Payment Security
Card Production Security
What the team coversLogical and physical security for card manufacturing, personalization and fulfilment environments.
Questions we are asked- Do our vault, personalization and key controls meet card production requirements?
- How do we prepare for a card brand security review?
Industries we see most- Banking & Financial Services
- FinTech & Payments
-
Financial Services Payment Security
Approved Scanning Vendor (ASV) Scanning
What the team coversQuarterly external scan programs: target scoping, remediation of failing findings, disputes and the passing evidence your acquirer expects.
Questions we are asked- Why do our quarterly scans keep failing, and how do we fix it?
- Which external hosts and IP ranges belong in scope?
Industries we see most- FinTech & Payments
- Retail & E-Commerce
- Technology & SaaS
-
Financial Services Payment Security
PCI Forensic Investigations (PFI)
What the team coversForensic readiness for payment incidents: logging, evidence preservation, response plans and preparation for a PCI Forensic Investigation.
Questions we are asked- If card data were compromised tomorrow, could our logs show what happened?
- What will an investigator need from us in the first 24 hours?
Industries we see most- FinTech & Payments
- Retail & E-Commerce
- Banking & Financial Services
-
Financial Services Banking & Regulation
SWIFT CSCF Assessments
What the team coversSWIFT Customer Security Controls Framework work: architecture type, mandatory and advisory controls, and independent assessment support for the annual attestation.
Questions we are asked- Which architecture type are we, and which controls apply?
- Will our attestation stand up to an independent assessment?
Industries we see most- Banking & Financial Services
- FinTech & Payments
-
Financial Services Banking & Regulation
DORA Readiness & Operational Resilience
What the team coversICT risk management, incident reporting, resilience testing, third-party risk and the register of information under the Digital Operational Resilience Act.
Questions we are asked- Is our register of information complete enough to submit?
- How do we test resilience in a way our supervisor will accept?
Industries we see most- Banking & Financial Services
- FinTech & Payments
- Cloud & AI Companies
-
Financial Services Banking & Regulation
NIS2 Readiness
What the team coversReadiness for essential and important entities: risk management measures, incident notification and management accountability under NIS2.
Questions we are asked- Are we an essential or an important entity?
- Can we meet the early warning and notification deadlines?
Industries we see most- Critical Infrastructure & Energy
- Healthcare & Life Sciences
- Government & Public Sector
- Cloud & AI Companies
-
AI, Cloud & Digital Trust AI Governance & Security
ISO/IEC 42001 Advisory & Readiness
What the team coversDesigning and implementing an AI management system, from AI policy and impact assessment to internal audit, ready for certification.
Questions we are asked- What must an ISO/IEC 42001 management system cover for our AI products?
- How far are we from a certification audit?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- Healthcare & Life Sciences
- Banking & Financial Services
-
AI, Cloud & Digital Trust AI Governance & Security
NIST AI Risk Management Framework
What the team coversApplying the NIST AI Risk Management Framework: govern, map, measure and manage AI risk across the model lifecycle.
Questions we are asked- How do we map our AI systems and their risks in a way leadership can use?
- Which measurements show our AI controls are working?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- Government & Public Sector
- Healthcare & Life Sciences
-
AI, Cloud & Digital Trust AI Governance & Security
EU AI Act Readiness
What the team coversSystem classification, gap analysis and the documentation, human oversight and transparency obligations of the EU AI Act.
Questions we are asked- Which of our AI systems are high-risk under the Act?
- What must be in place, and by when?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- Healthcare & Life Sciences
- Banking & Financial Services
-
AI, Cloud & Digital Trust AI Governance & Security
AIUC-1 Readiness
What the team coversReadiness for the AIUC-1 standard for AI agents: data and privacy, security, safety, reliability and accountability controls, evidenced for enterprise buyers.
Questions we are asked- Are our AI agents ready for an AIUC-1 audit?
- How do we show enterprise buyers that our agents are safe to deploy?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
-
AI, Cloud & Digital Trust AI Governance & Security
AI Red Teaming
What the team coversAdversarial testing of models, prompts, agents and guardrails: jailbreaks, data leakage, harmful output and tool misuse.
Questions we are asked- Can our assistant be talked into leaking data or taking unsafe actions?
- Do our guardrails hold against a determined attacker?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- Banking & Financial Services
- Healthcare & Life Sciences
-
AI, Cloud & Digital Trust AI Governance & Security
LLM & AI Application Security
What the team coversSecurity architecture and testing for LLM applications: prompt injection, retrieval data exposure, tool permissions and output handling.
Questions we are asked- Is our retrieval pipeline exposing data users should not see?
- What permissions should our AI tools and agents really have?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- FinTech & Payments
-
AI, Cloud & Digital Trust Cloud & Compliance Assurance
SOC 1 Readiness & Audit Support
What the team coversReadiness and audit support for SOC 1 reports: control objectives over financial reporting, control design and evidence your CPA firm can test.
Questions we are asked- Do our customers need a SOC 1, a SOC 2, or both?
- Which control objectives belong in our system description?
Industries we see most- FinTech & Payments
- Technology & SaaS
- Banking & Financial Services
- Healthcare & Life Sciences
-
AI, Cloud & Digital Trust Cloud & Compliance Assurance
SOC 2 Readiness & Audit Support
What the team coversReadiness, control design and evidence for SOC 2 Type I and Type II reports, across the Trust Services Criteria your buyers ask for.
Questions we are asked- Which Trust Services Criteria should we include?
- How quickly can we move from readiness to a Type II period?
Industries we see most- Technology & SaaS
- Cloud & AI Companies
- Healthcare & Life Sciences
- FinTech & Payments
-
AI, Cloud & Digital Trust Cloud & Compliance Assurance
ISO/IEC 27001, 27701 & 22301 Advisory
What the team coversInformation security management systems under ISO/IEC 27001, extended to privacy (27701) and business continuity (22301), ready to certify and built to keep improving.
Questions we are asked- What scope makes sense for our first certification?
- How do we keep the ISMS alive after the audit?
Industries we see most- Technology & SaaS
- Cloud & AI Companies
- Government & Public Sector
- Critical Infrastructure & Energy
-
AI, Cloud & Digital Trust Cloud & Compliance Assurance
FedRAMP & GovRAMP Assessment
What the team coversFedRAMP and GovRAMP readiness: authorization boundary, control implementation, System Security Plan and a package your sponsor and 3PAO can work with.
Questions we are asked- Which impact level and path to authorization fit us?
- Is our boundary drawn in a way the 3PAO will accept?
Industries we see most- Government & Public Sector
- Technology & SaaS
- Cloud & AI Companies
-
AI, Cloud & Digital Trust Cloud & Compliance Assurance
CMMC Assessment & NIST SP 800-171
What the team coversNIST SP 800-171 practices implemented and evidenced for CMMC Level 2, with a System Security Plan ready for your C3PAO.
Questions we are asked- Where does our controlled unclassified information live, and what is in scope?
- Which practices would fail an assessment today?
Industries we see most- Government & Public Sector
- Critical Infrastructure & Energy
- Technology & SaaS
-
AI, Cloud & Digital Trust Cloud & Compliance Assurance
Cloud Security Architecture & Posture
What the team coversCloud security architecture and posture across AWS, Azure and Google Cloud: landing zones, identity, guardrails, logging and continuous posture management.
Questions we are asked- Which identities could do the most damage if compromised?
- Are our guardrails enforced, or only documented?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- Healthcare & Life Sciences
- Banking & Financial Services
-
Offensive Security & Resilience Security Testing
Application Penetration Testing
What the team coversWeb application and API penetration testing that targets authentication, authorization, business logic and data exposure.
Questions we are asked- Can one customer reach another customer’s data?
- Where could an attacker abuse our business logic?
Industries we see most- Technology & SaaS
- Retail & E-Commerce
- FinTech & Payments
- Healthcare & Life Sciences
-
Offensive Security & Resilience Security Testing
Network Penetration Testing
What the team coversInternal and external network testing: exposed services, lateral movement, Active Directory and segmentation validation.
Questions we are asked- How far could an attacker get from one compromised laptop?
- Does our segmentation actually hold?
Industries we see most- Banking & Financial Services
- Critical Infrastructure & Energy
- Healthcare & Life Sciences
- Government & Public Sector
-
Offensive Security & Resilience Security Testing
Cloud Penetration Testing
What the team coversAttack-path testing in cloud environments: identity misconfiguration, privilege escalation and cross-account access.
Questions we are asked- Could a leaked key lead to a full account takeover?
- Which cross-account trust paths are dangerous?
Industries we see most- Cloud & AI Companies
- Technology & SaaS
- FinTech & Payments
-
Offensive Security & Resilience Security Testing
Mobile Application Security Testing
What the team coversiOS and Android application testing: on-device data storage, API security, authentication and tampering resistance.
Questions we are asked- What can an attacker learn from our app binary?
- Are tokens and personal data stored safely on the device?
Industries we see most- Retail & E-Commerce
- FinTech & Payments
- Healthcare & Life Sciences
- Banking & Financial Services
-
Offensive Security & Resilience Security Testing
Social Engineering & Physical Security Testing
What the team coversPhishing, voice phishing and physical entry exercises that test people and procedures under realistic pressure.
Questions we are asked- Would our help desk reset a password for a convincing caller?
- Could a stranger walk into our office or data room?
Industries we see most- Banking & Financial Services
- Healthcare & Life Sciences
- Critical Infrastructure & Energy
- Government & Public Sector
-
Offensive Security & Resilience Security Testing
Vulnerability Assessments
What the team coversVulnerability assessment and management programs: discovery, risk-based prioritization, remediation tracking and reporting.
Questions we are asked- Which vulnerabilities actually matter in our environment?
- How do we bring overdue critical findings down, and keep them down?
Industries we see most- Banking & Financial Services
- Healthcare & Life Sciences
- Retail & E-Commerce
- Critical Infrastructure & Energy
-
Offensive Security & Resilience Enterprise Assurance
Ransomware Resilience
What the team coversPreparation, containment and recovery: backup isolation, recovery testing, playbooks and executive exercises.
Questions we are asked- Could we restore critical systems from clean copies, and how fast?
- Who decides what in the first hour of an attack?
Industries we see most- Critical Infrastructure & Energy
- Healthcare & Life Sciences
- Government & Public Sector
- Banking & Financial Services
-
Offensive Security & Resilience Enterprise Assurance
Enterprise Risk Management
What the team coversEnterprise risk management frameworks, risk appetite, registers and board reporting that link technology risk to business decisions.
Questions we are asked- How do we present technology risk so the board can act on it?
- Is our risk register driving decisions or only recording them?
Industries we see most- Banking & Financial Services
- Healthcare & Life Sciences
- Critical Infrastructure & Energy
- Government & Public Sector
-
Offensive Security & Resilience Enterprise Assurance
Business Continuity & Disaster Recovery
What the team coversBusiness impact analysis, continuity strategies, disaster recovery plans and exercises that survive a real outage.
Questions we are asked- Which processes must recover first, and how quickly?
- When did we last prove our recovery plan works?
Industries we see most- Banking & Financial Services
- Healthcare & Life Sciences
- Critical Infrastructure & Energy
- Retail & E-Commerce
-
Offensive Security & Resilience Enterprise Assurance
Privacy & Data Protection
What the team coversPrivacy programs and data protection: data mapping, notices, consent, data subject requests and alignment with GDPR and U.S. state privacy laws.
Questions we are asked- Do we know where personal data lives and who can see it?
- Which privacy laws apply to us, and where are our gaps?
Industries we see most- Healthcare & Life Sciences
- Retail & E-Commerce
- Technology & SaaS
- FinTech & Payments
-
Offensive Security & Resilience Enterprise Assurance
Multi-Framework Compliance Programs
What the team coversOne unified control set and evidence model mapped across SOC 2, ISO/IEC 27001, PCI DSS, NIST frameworks and more, with continuous assurance between audits.
Questions we are asked- How many of our audits are testing the same controls?
- Can one evidence cycle satisfy every framework we answer to?
Industries we see most- Technology & SaaS
- FinTech & Payments
- Healthcare & Life Sciences
- Banking & Financial Services
No expertise matches those filters.
Try a broader term or clear a filter. If your question does not fit a box, tell us about it directly and the right practice lead will reply.
What happens next.
Choosing a team takes you to a short, confidential form with your topic already filled in. Nothing is shared until you send it.
You describe the question
Two minutes is enough: the topic, any deadline and who has to accept the result. We can sign a mutual NDA before any detail is shared.
The right practice lead replies
Your note goes to the practice that owns the subject, not to a sales queue. Expect a personal reply, usually within one business day.
A focused conversation
Thirty minutes on scope, timing and options. If it helps, we follow up with a written view or a proposal.
Bring us the question as it is.
Many questions cross practices. Describe yours and we will route it to the people who can answer it.