Ready before the test, fixed after it
We build the policies, evidence and plans a security review asks for, help you commission testing from a qualified provider, and see every finding through to a retest.
itf ask "does ecc apply to us"
ECC-2:2024 binds government bodies, their affiliates, and private organisations that own, operate or host critical national infrastructure.
Many other companies meet it through a customer, when a government buyer writes ECC requirements into the contract.
The clause then decides what you must show.
What you hold when the work ends
Many organisations have a firewall, antivirus and a backup product. What is often missing is quieter: the access review that leaves no record, the backup nobody has restored, the policy that still describes a tool nobody bought. Every engagement ends in documents that close those gaps, whatever the service.
The scope statement
What is in, what is out, and why. Agreed in writing before any other work starts, and yours to keep if you stop there.
The register the work produced
Controls, suppliers, findings or personal data, depending on the service. Every line carries a state and an owner.
The documents
Policies, plans and procedures, each with an owner and a review date, drafted for your own approval route.
The evidence map
For each control, the record that proves it runs and where that record lives, so the answer to a reviewer is a file you can open.
The action plan
The gaps in order, with owners and dates, written so another supplier could carry it out.
Nine services, each bought on its own
A first engagement often touches two, and ECC readiness brings policy work with it.
NCA ECC readiness
A control-by-control position against ECC-2:2024, with the evidence behind each answer.
Read moreSaudi regulationPDPL readiness
What personal data you hold, why you hold it, and the records SDAIA expects to see.
Read moreTesting, the buyer's sideCommissioning a penetration test
The scope, a comparison of providers, the report read on your side, and every fix tracked to the retest.
Read moreGovernanceSecurity policies and governance
A policy set sized to you, each policy paired with the record that proves it runs.
Read moreResilienceIncident response planning and tabletop exercises
Who decides what in the first hours, written down, then rehearsed with your leadership in the room.
Read moreGovernanceThird-party and vendor security
Suppliers tiered by what they touch, and their evidence checked for scope and date.
Read moreWith ITF DigitalSecure development advisory
Security requirements and review gates for teams that build software, and for companies that buy it.
Read moreWith ITF ConsultISO 27001
ITF Consult builds the management system. Cyber writes the security documents that sit inside it.
Read moreWith ITF TrainingSecurity awareness programmes
Who learns what, through which channels and how often. Designed here, taught by ITF Training.
Read moreWe know what a tester needs from you
We have studied how attacks are carried out, and we put that knowledge to work on your side of the table: in the scope before the test and in the report after it. It shows in small places. Each of these costs money if it surfaces during the test, so we look for it before the test starts or after the report arrives.
- A scope that lists the customer portal and forgets the API behind the mobile app
- A test window that opens before the test accounts exist
- A critical finding on an isolated lab server, graded above a medium on the page that takes payments
- A scanner export with a new cover page, sold as a manual test
How an engagement runs
Scope first, your documents read before any interview, and nothing handed over that another supplier could not pick up.
- 01
Call
What prompted this, who asked, and by when.
- 02
Scope
Entities, systems, sites and exclusions agreed in writing.
You receiveThe scope statement.
- 03
Read
Your existing documents, contracts and questionnaires, before any interview.
You receiveA document index.
- 04
Register
Controls, suppliers, data or findings, each with a state and an owner.
You receiveThe register.
- 05
Documents
Policies, plans and procedures drafted for your approval route.
You receiveThe document set.
- 06
Plan
The gaps in order, with owners and dates, walked through with management.
You receiveThe action plan.
Before you book
Do you run the penetration test?
A qualified provider you contract directly runs it, so their findings come straight to you. We write the scope, help you compare providers, read the report with you and track every fix to the provider's retest.
Why not let the testing firm handle all of it?
You can. The catch is that the firm selling the test then writes its scope, grades its own findings and decides what fixed means. Keeping the adviser separate from the tester keeps each of them honest.
Is ECC readiness the same as ISO 27001?
No. ISO 27001 is a certifiable management system, and ITF Consult owns that work. ECC is a national control set with no certificate. One evidence set can answer both.
What drives the cost?
The number of entities, sites and systems in scope, how much already exists in writing, how many people must be interviewed, and whether suppliers and cloud services are included.
Part of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Start with a written scope
Tell us what prompted this and who asked for it. The first thing you receive is a written scope, and you keep it whether or not you continue.