Every job ends with a signed confession.
Auditors, insurers and big customers want to know who tested, when, and what you did about it. Year-round testing answers all three, signed by an independent certified tester.
Why reports get sent back.
Auditors check three things before they read a single finding.
Who did it
A CREST accredited, ISO 27001 certified company. Nobody on your IT team signs their own homework.
When it was done
A report from eleven months ago fails the “after significant change” test. This is where most reports get sent back.
Whether anyone can read it
A summary your board understands and detail your engineers can act on, in one report.
What each framework asks for.
If yours isn’t here, ask us.
- NIS2
- DORA
- GDPR
- ISO/IEC 27001
- PCI DSS v4.0.1
- Cyber Essentials Plus
- SOC 2
- Cyber insurance
Article 21
NIS2
Essential and important entities must assess how well their security measures work.
Regular CREST-backed testing, with board-level summaries for management accountability.
Articles 24 to 27
DORA
Regular testing of ICT systems, and threat-led testing where the supervisor requires it.
Testing mapped to your resilience programme, with reports written for supervisors.
Article 32
GDPR
A process for regularly testing the security of the personal data you hold.
Dated, signed evidence that you test, and a record of what you fixed.
Control A.8.8
ISO/IEC 27001
Technical vulnerabilities identified and managed.
Continuous evidence from a company certified to ISO/IEC 27001:2022 itself.
Requirement 11.4
PCI DSS v4.0.1
Internal and external testing yearly and after significant changes, by a qualified, independent tester.
Covers the after-change part most businesses miss, with the independence statement your QSA looks for.
UK
Cyber Essentials Plus
A hands-on assessment of your boundary, devices, patching, access and malware controls.
We hold it ourselves and take UK suppliers through it.
Selling to US customers
SOC 2
Penetration test evidence across the whole audit period.
Tests, findings, fixes and retests for the whole year, in the shape your auditor asks for.
At renewal
Cyber insurance
How often you test, who does it and what you did with the results.
A clear answer to all three at renewal.
What your auditor gets.
Ready to hand over: what was tested, when, by whom, what was found and when it was fixed.
- Signed report with an executive summary
- Scope letter and rules of engagement
- Tester qualification and independence statement
- Retest evidence for every fix
- Attestation letter for your auditor, insurer or customer
- Methodology mapped to your framework
WhatsExposed demonstrated a profound understanding of cyber security principles and methodologies. Their expertise in identifying vulnerabilities and potential exploits was instrumental in enhancing security posture for our customers.
Ian O’CallaghanSecurity Division Lead, PFH, a Ricoh companyWorth reading next
Evidence for the whole year.
Tell us your framework and your domain, and we’ll come back with what we found and a plan.