BlueSteel Cybersecurity

BlueSteel Cybersecurity helps organisations prepare for and pass security compliance audits. It concentrates on healthcare and defence buyers, and on SaaS providers and government agencies, gathering audit evidence continuously as the work happens rather than piecing it together just before fieldwork.

Services

• Cybersecurity assessment: a scored gap assessment against the relevant control set, usually the first step of any engagement.
• Virtual CISO: an outsourced security leader for organisations without one on staff.
• Managed security compliance: ongoing control monitoring and policy management between audits.
• Application security and penetration testing: pen tests, source code review, DevSecOps, API assessments and cloud audits.
• Compliance preparation: policies, procedures and technical controls needed to stand up a compliant security programme.

Customers and markets

• SaaS and service providers holding customer data (SOC 2)
• Healthcare providers, payers and their vendors (HIPAA)
• Defence contractors handling controlled unclassified information (CMMC)
• Organisations selling abroad or to enterprise buyers (ISO 27001)

Key facts

• Frameworks: SOC 2, HIPAA, CMMC, ISO 27001, FedRAMP, HITRUST, NIST CSF, NIST SP 800-171, 800-53 and 800-218, PCI
• Method: Four phases - scope the boundary, assess, remediate, then attest and maintain