# How we work

> CyberAccord runs every engagement in five steps: a free scoping call, a fixed written quote, a senior-led assessment, hands-on delivery to close gaps, and a plain-English readout with evidence organized for auditors and customers. Certified practitioners do the work themselves, and findings are ranked by business risk rather than scanner severity.

Source: https://www.cyberaccord.com/approach

Every engagement follows the same five steps, so you know what you're buying, who is doing the work and what you'll have at the end.

## The engagement, step by step

1. **Scoping call.** A free 20-minute call to understand what's driving the need: an audit, a customer questionnaire, an insurance renewal or an incident.
2. **Fixed quote.** A written scope with defined deliverables and a fixed price. No open-ended meter.
3. **Assessment.** Senior practitioners test, review and interview against the framework or threat model in scope.
4. **Delivery.** We close gaps with you: hardening, policies, controls and managed protection where it fits.
5. **Readout and evidence.** A plain-English readout, findings ranked by business risk, and evidence organized for auditors and customers.

## Principles

- **Senior hands on the work.** The practitioners who scope your engagement are the ones who test, configure and prepare evidence. Nothing is handed down to juniors.
- **Protection that produces proof.** Managed security, testing and compliance come from one team, so the controls and the evidence that proves them come from the same place.
- **Framework-fluent.** Deliverables map to the frameworks your auditors and customers use: SOC 2, ISO 27001, HIPAA, PCI DSS, NIST and others.
- **Fixed scope, plain English.** Fixed quotes, defined deliverables, and findings explained in terms of business risk, with clear owners for each fix.

## How scoping and fixed quotes work

Scope comes from the scoping call: what's driving the need, which systems and frameworks are involved, and any deadline set by an auditor, customer or insurer.

We then send a written scope that lists what's in, what's out, the deliverables you'll receive and a fixed price. Work starts once you've agreed it.

If something changes partway through, such as a new system coming into scope, we agree the change in writing before doing the extra work.

## How we rank findings

A scanner's severity score describes a flaw in general. We rank each finding by what it means for your business.

- **Business risk first.** We weigh technical severity, using CVSS where it applies, against what is actually exposed in your environment: the data, systems and obligations affected.
- **An owner for every fix.** Each finding says who should fix it: your team, your IT provider or us. Nothing falls between teams.
- **Plain English.** Each finding explains what we found, why it matters and what to do next, with the technical detail kept for the people making the fix.

## Standards and methods we follow

OWASP WSTG, OWASP MASTG, OWASP Top 10 for LLM Applications, PTES, NIST SP 800-115, CVSS, CWE, NIST AI RMF, MITRE ATLAS

## Frequently asked questions

### Why a fixed quote instead of hourly billing?

A fixed quote makes scope explicit before work starts, so you know exactly what you'll receive and what it costs. If scope genuinely changes, we agree the change in writing first.

### Who actually does the work?

Senior certified practitioners. The people you meet on the scoping call are the people doing the testing, configuration and evidence preparation.

### What do we get at the end?

A readout session, a written report with findings ranked by business risk and clear owners, and evidence organized the way auditors and customer security reviewers expect to see it.

### Can you work with our existing IT provider?

Yes. Many engagements run alongside an in-house team or managed IT provider. We define who owns each fix up front so nothing falls between teams.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com
- Office: 8990 Kirby Dr, Suite 220, Houston, TX 77054