A five-step method, with a concrete deliverable at each step.
You know what happens at each stage, who takes part and what you receive at the end of it. The board can follow the work without waiting for a meeting.
The method
The method applies to all four areas: secure development, infrastructure, governance and compliance, and secure AI use. The content of each step changes. The order and the deliverables stay the same.
Assessment
We learn your environment, the policies your company already has and what the auditor or your client is asking for.
Who takes part: the analyst assigned to the project and the manager you appoint.
You receive: a picture of the starting point, with the most urgent risks.
Prioritized plan
We order the work by business risk and by the deadline you need to meet.
Who takes part: the analyst and whoever sets priorities in your company.
You receive: the plan with priorities, owners and dates.
Execution by our analysts
An assigned analyst carries out the plan within the rules of your environment. Every action is recorded.
Who takes part: the analyst, with access agreed with your team.
You receive: the fixes applied and the record of each one.
Continuous monitoring
After delivery, we keep watching configuration, vulnerabilities and controls. Your environment changes every week.
Who takes part: the analyst and the platform, which warns when something drifts.
You receive: drift alerts and up-to-date evidence on the platform.
Executive report
Each cycle ends with a report written for the board.
Who takes part: the analyst and your company’s board.
You receive: the report and dated evidence, ready for the audit.
Day-to-day rules
Everything is recorded
Every finding, fix and piece of evidence goes into the platform with a date and an author. You can check the history at any time.
Your company’s policies come first
The analyst follows the access, change and communication rules your company already has.
The references we follow
Our work follows public standards and guides. Each one has a role.
ISO/IEC 27001:2022
International standard for information security management. The basis of our governance and compliance work.
Public secure configuration benchmarks
Secure configuration recommendations for operating systems. The basis of hardening.
OWASP
Open application security foundation. The Top 10 and the SAMM model guide our secure development work.
LGPD
Brazil’s General Data Protection Law (Law 13,709/2018). The basis of privacy compliance.
The first conversation
You request the call
A short form with your name, company and area of interest.
We reply within 1 business day
A specialist schedules the call. It lasts 30 minutes.
You leave with three priorities
The specialist points out the three areas that most reduce risk in your environment.
Talk to a specialist for 30 minutes.
Tell us what your company needs. You leave the call with three priorities for your environment.
Prefer to write? Use the email contato@hegeon.com.br.