Security Assurance : Controls that are tested, not assumed.
Recovery · patching · evidence · identity · people
Golonex does not sell security products. We prove that the ones you run — or your vendors run — actually work: disaster recovery that has been rehearsed, patches that have been verified, access that has been reviewed, and evidence an assessor can follow. One named lead, one monthly report.
Under Fractional Leadership. The seat owns the program; security assurance proves the controls under it are real.
Six services. One accountable lead.
Engage the set, or start with the one your framework asks for first.
Disaster recovery & business continuity
Recovery objectives per system, a business continuity plan the board has signed, and restore and failover tests run on a schedule — with the results kept as evidence.
Details →Vulnerability & patch assurance
Continuous scanning of your estate, patch verification against the cycle your framework expects, and retests after fixes. Penetration testing scoped on discussion.
Details →Control testing & evidence
The controls your framework assumes are running — tested, not assumed. Each one mapped to CMMC / NIST 800-171, ISO 27001, SOC 2, or PCI DSS, with evidence an assessor can follow.
Details →Identity assurance
Access reviews, privileged-access evidence, and joiner-mover-leaver controls checked and documented across your identity estate.
Details →Security awareness & training
Training and phishing simulation with completion and click-rate evidence, plus AI-literacy training for EU AI Act Article 4.
Details →Vendor oversight
Your EDR, SOC, and email-security vendors stay. Golonex checks that what they run meets the framework, reads their reports, and holds them to the escalation tiers.
Details →Proof that the controls work.
An assessor does not take a vendor’s word for it, and neither do we. Each control is tested against what the framework actually asks, and the result is written up as evidence.
Endpoint and detection coverage
Every in-scope device enrolled, agents reporting, alerts reaching a person — verified against the asset inventory, not the vendor dashboard.
Logging and monitoring
The right sources feeding the right place, retention set to what your regulator expects, and someone acting on what is found.
Email and identity hygiene
DMARC enforced, MFA everywhere it is claimed, conditional access doing what the policy says.
Backup and restore
Immutable copies exist, restores work, and the recovery times match the plan.
Patching and configuration
Patch cycles met, baselines held, drift found and corrected — with the report to prove it.
Incident readiness
A plan, a contact list, a rehearsed tabletop, and the notification clocks (72-hour DFARS, six-hour CERT-In) written down before they are needed.
Preparing for an assessment? Readiness reviews for CMMC, ISO 27001, and PCI DSS use this evidence directly.
Your vendors stay. We hold them to the framework.
EDR, SOC monitoring, email security, backup platforms: these are run by specialists, and most firms already have them. Golonex does not replace them. We make sure what they run is what the framework needs — and that someone reads the reports.
- A written statement of what each vendor runs, what it covers, and what it does not — agreed with the vendor
- Their reports read every month by a Golonex engineer and summarised in your monthly report
- Escalation tiers in writing: who acts, who decides, and how fast, across your vendors and Golonex
- Where a product does not meet the framework, we say so in writing and recommend a replacement with the reason — we do not sell the replacement
Who runs it
An engineer for a steady estate. A team for an exercise.
Most assurance work is a steady cadence one engineer can own. Recovery exercises and large evidence programmes need more hands at once.
A named engineer
One Golonex engineer who knows your environment, dedicated or fractional, with a second engineer briefed to cover leave and escalation.
Fits when
- One estate in steady state: monthly control tests, patch verification, awareness
- Reading and summarising your vendors’ reports
- Access reviews on a quarterly cycle
A dedicated team
A lead who owns the outcome, a project manager (dedicated or fractional), and a dedicated delivery team with the specialists the work needs.
Fits when
- A DR or failover exercise, or a tabletop with the business
- Several sites or entities with separate evidence packs
- Building the first evidence set ahead of an assessment date
- A penetration test, where scoped
Always a team: recovery exercises. A failover test or a full restore needs the infrastructure, application, and business owners in the room at the same time.
Either way, one named lead answers for it — and reports to you every month.
A named lead who answers for it.
One named lead owns the assurance work and reports monthly. A project manager — dedicated or fractional — runs delivery and escalation. Every seat has a fixed monthly price, known before the month starts.
Need someone to own the program too?
A fractional vCISO or vCTO owns the risk register, frameworks, and board reporting, and directs the assurance work on this page.
The seat →The infrastructure underneath
Servers, cloud, and network — patched, baselined, and under change control — are run by managed infrastructure.
Managed infrastructure →Security assurance — your questions, answered
Do you sell or run EDR, email security, or a SOC? +
No. We do not resell security products and we do not operate a SOC. Those are run by the vendor you choose — or already have — and overseen by the seat. What Golonex provides is assurance: we verify that those controls are in place, working, and evidenced to the standard your framework expects.
Do you do penetration testing or red teaming? +
Red and blue teaming are not a product we sell. Penetration testing can be scoped on discussion, as part of vulnerability assurance, where your framework or customer requires it. The continuous work — scanning, patch verification, and retests — is the standing service.
How is this different from the seat? +
The seat owns the security program: the risk register, the frameworks, the policies, and the board report. Security assurance is the standing work that proves the controls under that program are real. You can have either on its own; together, the seat directs and assurance delivers the proof.
Where does disaster recovery sit? +
Here. Recovery objectives, the business continuity plan, and the tests that prove both are assurance work. We plan and test; the backup platform itself is yours or your vendor’s.
What do we get each month? +
One report: which controls were tested, what passed, what did not and what was done about it, patch compliance, restore-test results, and awareness results — written so it can go straight into your evidence pack.
Is it one engineer or a team? +
A named engineer for a single estate in steady state; a team where several sites, a DR exercise, or a large evidence programme are in scope. One named lead is accountable either way.
How is it priced? +
Fixed monthly pricing by seat, dedicated or fractional, set before the month starts. Engineer and lead seats carry a six-month minimum; teams three to six months, set by scope.
Tested, not assumed.
Bring the framework and the vendors you have today. Thirty minutes tells you which controls are proven, which are assumed, and what it takes to close the gap.
Managed delivery — seven practices · All managed delivery →
Managed GCC
Your Global Capability Center — set up, run, and handed over
02Managed talent
Supervised engineering seats in six practices
03Managed software delivery
Teams and builds with a Golonex lead on every engagement
04Managed infrastructure
Azure, AWS, Google Cloud, on-prem, and the data center
Security assurance
Recovery, patching, evidence, identity, and people — tested, not assumed
You are here
Managed Microsoft ecosystem
Microsoft 365, Azure workplace, and Dynamics 365
07Managed process & AI automation
A process lead in your business, automating the work