Schedule G · Guide · Security Advisory
A clearer direction for your security program.
Turn security requirements into a practical, accountable roadmap.
Assess where you are, decide what matters next, and build a practical roadmap. Security guidance that connects controls, business risk, and the people accountable for improvement.
What Schedule G covers
Clause G.1: Cybersecurity assessments
Review the agreed environment, controls, and processes to understand strengths, gaps, and priorities.
Clause G.2: Program & roadmap development
Create a sequenced improvement plan that reflects your resources, business dependencies, and risk priorities.
Clause G.3: Framework alignment
Discuss alignment with NIST CSF, relevant NIST 800-series guidance, CIS Controls, SOC 2, HIPAA, or PCI DSS requirements as applicable to your organization.
Clause G.4: Control & evidence readiness
Review control implementation, ownership, and supporting evidence. Advisory support does not provide formal certification or independent audit opinions.
Clause G.5: Tabletop exercises
Practice response decisions with technical and executive stakeholders, and turn observations into assigned improvements.
Clause G.6: Executive & vCISO support
Discuss an advisory scope for leadership reporting, risk communication, and security program direction that complements your internal team.
Sequence.
How the work runs once the scope is agreed. Five stages, in order, and every finding feeds the next.
Assess
Prioritize
Plan
Implement
Review
Supplied under this schedule.
Agree the work up front. Keep ownership clear. Leave your team with practical next steps and information it can use.
Request an assessmentConditions: specific coverage, technologies, testing boundaries, availability, and deliverables are agreed in your statement of work. Advisory and compliance support do not constitute certification or an independent audit opinion.
Let’s talk security advisory.
Tell us what you’re working with and where you need support. We’ll help define a useful next step, and the scope comes before any work.
Prefer email? Info@deadlocksec.com. Security incident? Use the incident path; the general channel has no guaranteed immediate response.
