Rule research
Reads regulatory text, assessor guidance and enforcement history, then expresses it as a versioned, testable rule.
Accountable to
Research function, per-framework control owner.
Engagement model
How an engagement actually runs.
A DeshCyber engagement runs in four stages — onboard, instrument, operate, attest — and each stage ends in a dated artefact the client keeps whether or not the engagement continues.
No discovery theatre and no maturity scores. The first stage produces a scoped control register; the last produces evidence an assessor can verify without us.
The four stages
01Sequential, time-boxed, and each closed by an artefact rather than a status call.
- 01
Onboard
Scope the obligations that apply, name the control owners and agree what evidence counts.
ArtefactScoped control register.
- 02
Instrument
Connect the systems that already hold the truth so evidence is collected where work happens.
ArtefactLive evidence feeds.
- 03
Operate
Run the published rules continuously, route exceptions to owners and keep the record current.
ArtefactDated verdicts and exception log.
- 04
Attest
Package the evidence for the board, the regulator or the assessor in the format each expects.
ArtefactFiling-ready evidence pack.
The three disciplines behind it
02Separate functions with separate accountability, so no team grades its own output.
Evidence engineering
Builds the collectors and exports that turn live system activity into artefacts with inputs and timestamps attached.
Accountable to
Engineering function, platform owner.
Assurance review
Re-runs rules independently, samples verdicts and challenges anything that cannot be recomputed.
Accountable to
Assurance function, independent board line.
Terms, stated before you ask
03The commercial and operational facts most reviewers need in the first meeting.
- Entry point
- One framework, one entity
- First artefact
- Within the onboarding stage
- Team shape
- Named owners on both sides
- Reporting
- Board-ready and assessor-ready
- Success measure
- Time from event to filed evidence
- Exit
- Evidence stays with the client
We start where the deadline is closest, then reuse the evidence elsewhere.
The control register lands before any platform work is committed.
One control owner from the client, one delivery owner from us.
The same underlying record is exported for each audience.
Agreed at onboarding and reported for the life of the engagement.
Records, rule versions and exports remain usable if the engagement ends.
Go deeper on who we are
06The principles, people and engagement model behind the structure above.
Bring us the framework with the nearest deadline.
We will scope it, name the evidence and show you the artefact the first stage produces.