The starting point
FreshWave wanted public sector contracts, and public sector buyers ask for evidence: certifications, audits, proof that security claims survive independent checking. The trap in every assurance exercise is the snapshot problem: an estate polished for inspection day and drifting the day after, exposed at the next check in front of exactly the buyers it was meant to impress.
The approach
One senior CyPro practitioner led the work with the re-inspection in mind from the first day. Controls were chosen because the business could genuinely operate them, technical hardening was done by engineers from CyPro’s wider bench rather than left as recommendations, and the evidence trail was built into ordinary routines. Passing the first check was treated as a side effect of being secure, not the objective.
The outcome
The assessments passed and public sector contracts followed, citing the assurances directly. More telling is what happened afterwards: each subsequent inspection confirmed the posture rather than catching the drift. That is the standard we hold tenant assessments to as well, which is why every engagement ends with a re-test and an annual rhythm rather than a certificate and a goodbye.
