Fixed scope, fixed price
Priced by framework, boundary, and evidence volume, agreed in writing before work begins. Changes to scope are documented and priced separately, never slipped in.
How we audit
Six phases. Zero surprises.
Our method is built on one rule from the flight line: you don't sign off on what you haven't inspected. Every finding is tied to evidence we examined, rated on a published scale, and reviewed with you before it becomes final.
01
Scoping
We agree on the framework, the boundary (systems, sites, documents, or programs in scope), the evidence you already hold, and the people we'll need time with. You get a fixed-scope, fixed-price statement of work before anything else happens.
Output: signed scope and evidence request list
02
Evidence collection
Policies, configurations, screenshots, tickets, training records, code, and interviews, collected through a secure evidence exchange and organized against every control or success criterion in scope. We tell you exactly what's missing before we start testing.
Output: evidence inventory with coverage gaps
03
Testing & analysis
We examine, interview, and test, following the assessment procedures the requirement itself publishes wherever they exist. Automated tooling supports the work; it never replaces the human judgment.
Output: draft findings with evidence references and severity
04
Findings review with you
Before anything is final, we walk every finding with your team. If we misread a control, missed evidence, or rated something wrong, this is where it gets corrected. Nothing reaches the final report that your team hasn't seen.
Output: validated findings and management response log
05
Final report & briefing
A written report with an executive summary, scored results by domain, a severity-rated risk register, and a prioritized gap list any remediation team can execute. We brief leadership in plain English and stay available for your remediation team's questions.
Output: final report, executive briefing, prioritized gap list
06
Independent verification
You remediate with whoever you choose. When you're ready, we re-test the open findings and issue a verification report. Because we had no role in the fix, the closure is credible to anyone who reads it.
Output: verification report and closure status
Severity scale
Every finding rated the same way.
Ratings are driven by likelihood and impact against the framework's intent and your actual exposure, never by how much the fix would cost or who would do it.
| Critical | Control absent or failed in a way that creates immediate regulatory, contractual, or safety exposure. Address first. |
|---|---|
| High | Control materially deficient; likely to be cited by an assessor or block a user with a disability from completing a task. |
| Medium | Control partially implemented or inconsistently applied; would be cited but is not an immediate blocker. |
| Low | Minor deviation or documentation gap; fix in the normal course of business. |
| Observation | Not a finding. A practice worth improving or a risk worth watching. |
What's in the report
- Executive summary written for people who won't read the rest
- Scope, boundary, methodology, and limitations stated plainly
- Scored results by control family, principle, or function
- Finding-level detail: what we tested, what we found, the evidence, the severity, and what it means
- Risk register mapped to the framework and, where useful, cross-walked to related frameworks
- Prioritized gap list your remediation team can work from directly
- Management response log capturing your team's input from the review
Evidence is the product. Opinions are free, and we don't sell those either.
Engagement terms
How we work
Remote first, on site when it matters
Most assessments are delivered remotely through a secure evidence exchange. On-site work is available across the DFW metroplex and, for government clients, by arrangement statewide.
Your data stays yours
Evidence is handled under a written confidentiality agreement, stored only for the engagement and any agreed retention period, and never used to market to you or anyone else.
Ready for a report you can stand behind?
Book a 30-minute scoping call. We'll confirm the framework, the boundary, and the evidence you already have, and you'll leave with a fixed-scope proposal. No pitch for services we don't offer.