Security and Assurance

When this fits

You need to know how a system can be attacked and what evidence shows that its controls work.

What the work covers

• A threat model across identity, data flow, network design and service boundaries.
• Hardening of the system to that model.
• Control checks that produce evidence repeatedly, not once.
• Incident readiness: escalation paths, evidence handling and a rehearsal.

What you receive

• A written threat model and the findings against it.
• The changes made, or a plan for those the customer chooses to make.
• The control checks and their results.

How completion is decided

Each finding is closed, accepted by name or left open with its reason recorded, and the control checks are shown to fail when the control is removed.

What you provide

• Access to the system and its owners, within an agreed scope.
• Written authority for any testing of live systems.

What RJV does not promise

• A fixed price or duration before the scope is known.
• Regulatory approval or a certificate; the customer remains the regulated party.
• That a system cannot be breached. An assessment states what was examined and what was not.

How to start

Describe the problem on the Work with Us page. Every engagement follows the stages on the engineering page, and the commercial terms explain what determines scope and how the work is charged. Ownership at handover is described in deployment and ownership.