FAQ
Useful answers before the work begins.
What to expect from our compliance, Virtual CISO, information security training and penetration testing services.
Where do we start?
With a focused conversation about your activities, current position and desired outcome. We identify the right service or combination of services, then agree the scope and next steps.
How long will it take?
Timing depends on the service, scope, participants and material already available. We agree a schedule for assessments, training or testing, and working hours and regular progress reviews for Virtual CISO engagements.
What will we receive?
Outputs depend on the service: a gap matrix and action plan for compliance, risk oversight and progress reviews for Virtual CISO, tailored content and practical scenarios for training, and a technical report with remediation guidance for penetration testing.
How do you work with our team?
We work with your nominated contacts. Depending on the service, this may involve management, IT, risk, legal or other colleagues. We agree their input and responsibilities in advance.
Can you work remotely or on site?
Yes. We agree the working model around scope, team needs and secure collaboration conditions.
Does compliance equal security?
Not necessarily. Compliance can provide an important governance structure, while security also depends on operating controls, decisions and culture.
Do you carry out penetration testing?
Yes. Glesum organises and delivers penetration testing within an agreed scope, working with technical specialists. Systems, scenarios and written authorisation are agreed before testing. Outputs include findings, an explanation of their impact and remediation guidance; retesting is agreed separately.
How do you handle confidential information?
Information is used only for the agreed purpose and handled with proportionate collaboration and access measures. Specific terms are agreed before work begins.