Three tiers. Controls where they count.
Applying every control to every system wastes time and money, and it isn't risk-based. By default we build a three-tier control standard, so your most important systems get the strongest protection, lower-risk systems get what they need, and security effort matches your risk tolerance. It flows straight from your risk assessment and data classification, with a proven process and automation behind it.
- Default model
- Three control tiers
- Built from
- Your risk assessment and data classification
- Mapped to
- NIST SP 800-53, CIS or yours
- Behind it
- A proven process and automation
What makes it different
Risk-based, not one size fits all.
Putting every control on every system sounds safe. In practice it spreads time and budget thin, slows teams down, and leaves the systems that matter most no better protected than the ones that don't. A tiered standard puts the strongest controls where the risk is highest, in line with the risk tolerance your leadership set.
Three tiers
Proportionate by default.
Every standard we build has three tiers. Each system gets the controls its tier requires, no more and no less.
Connected
One flow, start to finish.
Your risk assessment sets the tolerance. Data governance classifies your systems and information. The control standard follows directly from both.
Automated
Expertise with automation behind it.
If you have done the earlier work with us, our automation turns it into control standards quickly and consistently. Not a basic template filled in by hand.
The problem
Why control standards miss the mark.
Most organizations either have no standard at all, or one that treats every system the same.
- Every control everywhereLow-risk systems held to the same bar as critical ones.
- Time and money wastedEffort spent where it changes very little.
- Critical systems underprotectedThe strongest controls spread too thin to land where they matter.
- Generic templatesA downloaded control list with no link to your risk or your data.
- Disconnected workAssessment, classification and standards done separately, so nothing lines up.
How it works
From risk, to tiers, to controls in place.
Simple for you, because each step feeds the next. If you have already been through a risk assessment and data governance with us, most of the input already exists and our automation does the heavy lifting.
- 01
Start from your risk
Your risk assessment and risk tolerance set how much protection each level needs.
- 02
Classify systems and data
Data governance places your systems and information in tiers by how much they matter. If that isn't done yet, we do it with you first.
- 03
Build the three-tier standard
Minimum controls for each tier, mapped to your framework and generated with our automation.
- Tier assignments for your systems
- Controls per tier, mapped to NIST SP 800-53, CIS or yours
- Expert review, not a raw template
- 04
Implement
Hands-on support with IT, engineering and security to put the controls in place.
- 05
Evidence and alignment
Proof collected for audit, and policies kept in step with the standard.
Compliance readiness
Preparing for SOC 2, ISO 27001, HIPAA or a customer audit? We assess against the framework, map the controls you already have back to it, and fill the gaps, ranked by business risk so you fix what matters first.
Who it's for
Clear for leaders. Practical for teams.
For business leaders
Spend where the risk is.
- Risk-based spendBudget follows what matters most.
- Aligned to toleranceProtection matches the risk appetite you set.
- DefensibleA clear reason behind every requirement.
For it and security teams
Know exactly what each system needs.
- Clear requirementsA system's tier tells you its controls.
- Less wasted effortNo gold-plating low-risk systems.
- Audit-readyControls mapped and evidence collected as you go.
What you get
Control Standards deliverables.
Concrete artifacts you keep, not a slide deck that disappears after the readout.
- 01
Three-tier control standard
Minimum controls for each tier.
- 02
System tier assignments
Every in-scope system placed in a tier.
- 03
Framework mapping
NIST SP 800-53, CIS or your internal standards.
- 04
Implementation support
Hands-on help putting controls in place.
- 05
Audit evidence
Collected during implementation, ready to share.
- 06
Policy alignment
Standards and policies that say the same thing.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →“Every control on every system isn't careful. It's just expensive.”CyberRisk One
Connected services