Understand your current control environment

This tier provides a structured, evidence-led review of your governance, cyber, and privacy environment. Infoways identifies controls in place, requests supporting evidence, and maps findings against a defined internal methodology aligned to recognised governance, security, and privacy frameworks. This tier can be delivered through two structured components depending on the scope defined in the applicable Statement of Work:

1. Presence-Based Evidence Mapping

Focused on identifying whether stated controls exist and whether supporting evidence has been provided.

This includes:

• Identification of controls described or asserted by the Client

• Request and review of supporting artefacts provided by the Client

• Mapping of evidence to relevant control requirements or framework references

• Classification of evidence status (e.g. present, partial, not present, or not applicable)

This component is limited to evidence identification and mapping and does not include assessment of control effectiveness, adequacy, or operational performance.

2. Governance & Control Uplift Support (Optional Engagement)

Where included as a separately scoped project engagement, Infoways may assist organisations in improving, documenting, and operationalising governance and control practices identified during the Discovery & Independent Verification process.

This may include:

• Guidance on control implementation approaches

• Support in structuring governance documentation and policies

• Assistance in translating identified gaps into remediation actions

• Advisory support during control implementation activities

• Coordination support across internal teams or external providers

• Assistance in aligning controls to recognised governance and security frameworks

This engagement is advisory and implementation-support focused in nature. Responsibility for implementation, operation, and ongoing control management remains with the Client.

Outcome

A structured, point-in-time evidence mapping and governance visibility exercise, supported by structured observations intended to assist internal decision-making and, where relevant, support discussions with insurers, auditors, or other stakeholders.

Establish the foundations needed to understand, document, and begin managing your governance and control environment.

Bronze is designed for organisations that need more than a gap check. We combine independent verification with practical support to help clients identify core controls, understand privacy and data sensitivity obligations, map priority cyber risks, and begin building the records and structure needed for ongoing governance.

This tier helps address:

• Limited visibility over key controls and privacy obligations.

• Unclear priorities for cyber and governance risk.

• Difficulty evidencing what is in place and what needs attention.

• Lack of a practical platform to manage GRC activity.

Outcome: a verified starting point, a foundational risk and privacy view, and a structured governance base supported through our GRC platform.

Turn governance into a repeatable part of how the organisation operates.

Silver builds on Bronze by extending control visibility, strengthening incident readiness, and supporting more consistent management of third-party and internal governance activities. It is designed for organisations that have started formalising controls and now need a more reliable operating rhythm.

This tier helps address:

• Inconsistent control execution.

• Limited incident preparedness.

• Gaps in supplier and third-party oversight.

• Fragmented governance documentation and reporting.

Outcome: an operational governance capability supported by recurring reporting, structured reviews, and clearer accountability across key risk areas.

Provide leadership with deeper confidence in control maturity, privacy readiness, and governance resilience.

Gold builds on Silver with more comprehensive review, broader third-party oversight, deeper privacy assessment, and the ability to assess against multiple frameworks where needed. This tier is suited to organisations that need stronger evidence, broader assurance coverage, and reporting that can support strategic decision-making.

This tier helps address:

• Board-level uncertainty around governance and risk exposure.

• Greater scrutiny from customers, insurers, or regulators.

• The need for broader and more defensible governance evidence.

• Multi-framework reporting requirements.

Outcome: structured governance reporting that demonstrates a mature, defensible, and better-evidenced control environment.

Assurance is not a one-time exercise. Continuous governance support is available across the Bronze, Silver, and Gold tiers, with specific activities and frequency tailored to the selected service scope.

For organisations that need ongoing support, Infoways provides a recurring governance and control monitoring layer designed to help maintain visibility, support evolving requirements, and keep priority actions moving.

Depending on the selected service level, this may include:

• Access to the Infoways helpdesk and capped advisory support.

• Regulatory and threat update briefings.

• Monthly or quarterly catchups.

• Control evidence review through our GRC platform.

• Monthly or quarterly maturity reporting.

• Support with cyber insurance questionnaires.

• Guidance on incident response readiness and response support.

• Maintenance of cyber risk registers.

• Assistance with GRC documentation and artefacts, where the client retains implementation responsibility.

• Vendor risk triage and ongoing framework alignment.

Outcome: sustained governance visibility, better continuity between reviews, and ongoing support for control maturity and operational resilience.