A customer questionnaire, an auditor's date, a penetration test nobody can rank. Application security, testing and compliance readiness, aimed at the exposure rather than the paperwork.
The questionnaire came attached to a contract, and half of it asks about controls nobody in the building owns. Or a penetration test landed with a page of red findings and no way to tell which one an attacker would reach first. Security work usually begins under somebody else's deadline. The question worth asking is narrower than whether you are secure: what could someone do from where they already stand, and what would stop them.
Plenty of security spending buys documents: a policy set written against a template and never read, a findings report ageing on a shared drive, a questionnaire answered for the version of the system somebody hoped existed. None of it is dishonest. It does not change what an attacker can do.
An auditor does not grade your intentions. They ask for the record: who approved that access, when the key was last rotated, what the review of that release found, and they ask for it across a period rather than on the day of the visit. A control that exists in a document but leaves no trace behind it will fail on the second question every time.
Which is why the work aims at the systems rather than the binder. Access reviews that come out of the identity provider, change history that already records who approved what, alerts that prove monitoring was running and not merely configured. Evidence assembled the week before an audit is expensive, and it is the kind a good auditor tends to notice. The sort that falls out of systems working properly costs nothing extra, and it holds up next year too.
They overlap, and a questionnaire that cannot be answered honestly often turns into a review, which turns into a list of things to fix.
| Framework | What it asks | Usual shortfall |
|---|---|---|
| GDPR (EU) | Lawful basis, minimisation, breach notification | No record of what data sits where |
| KVKK (Türkiye) | VERBIS registration, explicit consent, transfer limits | Data copied abroad without a lawful basis |
| SOC 2 | Your stated controls, evidenced over time | Evidence assembled late, periods with gaps |
| ISO 27001 | A management system, not a checklist | Risk register written once, never revisited |
| PCI DSS | Cardholder data scoped, segmented and scanned | Scope wider than anyone had assumed |
No. We are not an auditor and cannot issue a certificate or an attestation; depending on the framework that comes from an accredited certification body or a licensed audit firm. A consultancy that offers to do both should worry you. What we do is the readiness work in front of it, and we can sit in the room when the auditor starts asking.
Problemi bir paragrafta anlatın, hangi hizmetin gerçekten karşılık geldiğini söyleyelim.
