MECi CyberReady 360™: Cybersecurity, Compliance & Trust Program

Build stronger security. Prove compliance. Earn customer trust.

Index

The MECi CyberReady 360™ Program — what’s included
Your CyberReady™ Action Plan — the full checklist
CyberReady 360™ Service Tiers & Pricing
Frequently Asked Questions

1. The MECi CyberReady 360™ Program

Objective

MECi CyberReady 360™ helps organisations assess, strengthen, and operate their cybersecurity and compliance programmes. The engagement covers organisational and technology inventory, framework applicability and control mapping, control and technical assessments, evidence management, risk and remediation tracking, audit and customer-review readiness, and agreed ongoing monitoring and reporting. The applicable frameworks, systems, testing activities, deliverables, and service cadence are confirmed in the client proposal.

1. Framework coverage

Review the complete framework catalog below to identify requirements relevant to the client’s business, jurisdictions, contracts, products, and systems. Document applicable requirements, mapped controls, evidence, test results, owners, gaps, and remediation status within the agreed engagement scope.

Security: SOC 2; ISO 27001; PCI DSS; NIST CSF 2.0; NIST 800-53; NIST 800-171; CIS v8.1; Cyber Essentials; AWS FTR; MVSP; OFDSS
Privacy: GDPR; US Data Privacy; HIPAA; ISO 27701; ISO 27018
AI: ISO 42001; EU AI Act; NIST AI RMF; Agentic Trust Controls
Government and critical sectors: FedRAMP; FedRAMP 20x; CMMC 2.0; CJIS; NIS 2; DORA; CPS 234; Essential Eight; 23 NYCRR 500; CRI Profile; TISAX; BSI C5
Other: HITRUST CSF; ISO 27017; ISO 22301; Microsoft SSPA; ISO 9001; SOX ITGC; Custom Frameworks

For each framework determined to be applicable to the client, maintain its requirements, mapped controls, evidence, test results, owners, gaps, and remediation status within the agreed scope. Map shared controls once and cross-reference them wherever they satisfy multiple requirements. Track relevant framework updates and revise the mapping when requirements change. The full catalog is reviewed for applicability; detailed mapping and ongoing maintenance are defined in the proposal.

2. Organisation and technology inventory

Inventory business units, locations, personnel, data types, business services, systems, and control owners.
Record endpoints, identities, cloud environments, networks, applications, repositories, SaaS platforms, vendors, data stores, and backups.
Document system ownership, business criticality, data sensitivity, dependencies, and data flows.
Identify internet-facing assets, privileged accounts, service accounts, and systems that process regulated or customer data.
Maintain the inventory as a living register and reconcile it regularly against source systems.

3. Control library and evidence operations

For each control, record its objective, owner, frequency, procedure, mapped requirements, evidence source, test method, status, exceptions, and remediation tasks.

Review, write, and maintain security policies and operating procedures.
Collect evidence from approved system integrations, configuration exports, records, interviews, and samples.
Keep an evidence register with source, date, owner, review history, and mapped controls.
Monitor evidence freshness and control completion; send reminders and route failures to accountable owners.
Maintain audit-ready evidence rooms and an auditable history of control changes, test results, approvals, and remediation.

4. Security, access, and workforce controls

Assess and test:

Identity lifecycle, SSO, MFA, authentication policies, privileged access, service accounts, and access reviews
Hiring, role changes, termination, contractor access, training, and policy acknowledgement
Endpoint inventory, device management, encryption, screen lock, patching, endpoint protection, and administrator privileges
Asset ownership, secure configuration, change management, and exception approval
Security responsibilities, governance, risk acceptance, and management review

Sample actual user and system records to validate that procedures operate as documented.

5. Cloud, infrastructure, applications, and technical testing

Review cloud permissions, network exposure, logging, encryption, secrets, backups, configuration management, and administrative access.
Assess network segmentation, remote access, firewalls, servers, databases, and critical infrastructure.
Review application architecture, authentication, authorisation, data handling, APIs, repositories, code review, CI/CD, dependencies, and secrets management.
Perform the agreed external attack-surface review, vulnerability assessment, and configuration assessment. Penetration testing is performed only when it is included in the proposal and expressly authorised for the specified company assets.
Validate findings, assign risk and remediation priority, and retest completed fixes.
Review security logs, alert routing, incident escalation, and records of prior events.

6. Risk, vendors, incidents, and resilience

Maintain an enterprise security risk register with impact, likelihood, treatment, accountable owner, and due date.
Assess vendors according to their access, data handled, and business criticality; track due diligence, reassessment, issues, and offboarding.
Review and exercise incident-response plans, escalation procedures, communications, and decision-making.
Conduct incident-response tabletop exercises and document actions and lessons learned.
Assess business continuity and disaster recovery; verify recovery priorities, dependencies, backups, and restoration results.

7. Privacy, AI governance, and customer trust

Maintain data inventories, processing records, retention rules, privacy assessments, and data-subject request procedures where applicable.
Inventory AI systems and uses; assess ownership, data, model/vendor risks, human oversight, transparency, and AI-related controls.
Manage customer security commitments and track evidence supporting those commitments.
Prepare and maintain accurate security questionnaire responses, with each answer linked to approved evidence and an accountable owner.
Maintain a customer-facing trust package containing approved policies, reports, certifications, and security answers.

8. Remediation and continuous monitoring

Create a tracked corrective action for each control failure, risk, vulnerability, audit issue, or exercise finding.
Assign severity, owner, due date, required evidence, and retest procedure.
Escalate overdue and critical items to management.
Monitor agreed security and compliance indicators on an ongoing basis, including access changes, device status, vulnerabilities, evidence freshness, training, vendor reviews, backups, and remediation.
Provide monthly status reviews and quarterly control testing; refresh the full risk assessment and framework mapping annually and when major systems or business operations change.

Deliverables

Enterprise system, asset, data-flow, vendor, and control-owner inventories
Framework-to-control matrix covering applicable frameworks and requirements within the agreed scope
Security policies and procedures
Control and evidence register with test history
Technical assessment reports and, when included in the proposal, penetration-test reports
Enterprise risk register and prioritised remediation plan
Vendor risk register and assessment records
Incident-response tabletop and recovery-test reports
Privacy and AI governance registers and assessments
Audit evidence room and customer trust package
Security questionnaire response library with evidence links
Executive dashboard, monthly status reports, and quarterly review materials

Delivery plan

Weeks 1–2: discovery, system inventory, stakeholder interviews, authorisation, and framework mapping
Weeks 3–6: control assessment, evidence collection, policy review, and technical review
Weeks 7–9: authorised testing, vendor and resilience reviews, and control validation
Weeks 10–12: findings, remediation planning, evidence-room setup, executive readout, and monitoring launch
Ongoing: monthly monitoring and remediation review, quarterly testing and reporting, and annual program refresh

The engagement is complete when the inventory and framework mapping are established, controls have been assessed and tested, findings have owners and corrective actions, deliverables have been handed over, and the ongoing monitoring cadence is operating.

2. Cybersecurity, Compliance & Trust Checklist

How to read this inventory: This is the reference catalog used to identify potentially relevant frameworks, standards, regulations, and control sets. It is not a statement that every item applies to every client, or that every item is fully implemented or certified in every service tier. MECi confirms applicability and agrees the client-specific scope and deliverables before starting the engagement.

We use one status record for every checkbox: Owner · Due date · Evidence link · Result · Follow-up ticket.

Items are marked complete only when its evidence is saved and reviewed—not merely when someone says it is done.

1. Engagement setup and authorisation

Name the executive sponsor, engagement lead, system owners, framework owners, and escalation contacts.
Create a contact list with normal-hours and urgent incident contacts.
Set up an access-controlled evidence repository and define its access permissions.
Set the engagement calendar, interview schedule, status meetings, and reporting dates.
Obtain written authorisation for system access, scanning, and penetration testing.
Record the authorised organisations, domains, IP ranges, cloud accounts, applications, and environments.
Agree on test windows, emergency contacts, stop conditions, and how unexpected findings will be reported.
Establish a secure process for sharing sensitive evidence and technical findings.
Create a central work tracker for controls, evidence requests, findings, decisions, and remediation.

2. Organisation, systems, and data inventory

List legal entities, business units, operating locations, and countries where the company operates.
List employee, contractor, administrator, and service-account populations.
Identify business-critical services, products, and customer-facing processes.
Inventory endpoints, servers, networks, cloud accounts, applications, databases, repositories, and SaaS platforms.
Inventory identity providers, HR systems, ticketing systems, monitoring tools, and backup platforms.
Inventory third parties that store company data, access company systems, or provide critical services.
Record an owner, purpose, criticality, environment, and lifecycle status for each in-scope system.
Record the data types each system stores, processes, or transmits.
Classify data by sensitivity and record applicable retention and handling requirements.
Diagram major data flows, integrations, trust boundaries, and external connections.
Identify internet-facing assets, privileged pathways, service accounts, and systems processing sensitive data.
Reconcile the inventory against source systems and resolve missing, duplicate, or unowned assets.
Publish the approved inventory and record the date and method for refreshing it.

3. Framework applicability and mapping

For each framework below:

Record the authoritative version and applicable assessment period.
Assess applicability requirement by requirement.
Document the rationale and evidence for each applicable or not-applicable determination.
Map each applicable requirement to a control, control owner, evidence source, test procedure, and review frequency.
Link shared controls to every framework requirement they support.
Identify gaps, exceptions, compensating controls, and required corrective actions.
Review mappings with the relevant control owners and approve the final mapping.
Record how framework updates will be monitored and incorporated.

Framework register:

SOC 2
ISO 27001
GDPR
US Data Privacy
ISO 42001
PCI DSS
NIST CSF 2.0
HITRUST CSF
FedRAMP
FedRAMP 20x
CMMC 2.0
DORA
ISO 27701
Cyber Essentials
NIST 800-53
NIST 800-171
EU AI Act
NIS 2
NIST AI RMF
ISO 27017
ISO 27018
ISO 22301
AWS FTR
MVSP
OFDSS
CIS v8.1
CPS 234
CJIS
23 NYCRR 500
TISAX
Microsoft SSPA
ISO 9001
Essential Eight
CRI Profile
SOX ITGC
BSI C5
Agentic Trust Controls
Custom frameworks and customer-specific requirements

4. Control library and evidence process

Create a control record for every security and compliance control.
Assign each control an accountable owner and backup owner.
Document the control objective, procedure, frequency, systems covered, and approval path.
Identify the evidence source and collection method for each control.
Define how each control will be tested and what constitutes a passing result.
Define how exceptions are requested, risk-reviewed, approved, time-limited, and closed.
Collect an initial evidence sample for every in-scope control.
Verify evidence dates, completeness, authenticity, and alignment with the control.
Link evidence to the relevant controls and framework requirements.
Record evidence owner, source, collection date, review date, and access permissions.
Set evidence renewal reminders according to each control’s frequency.
Record control failures and missing evidence as tracked remediation items.
Maintain a history of control changes, evidence updates, approvals, and test results.

5. Governance, policies, and risk management

Review security roles, reporting lines, decision rights, and management oversight.
Review the information-security policy and supporting procedures.
Review risk-assessment methodology, risk acceptance, and escalation thresholds.
Complete an enterprise security risk assessment covering business, systems, data, vendors, and threats.
Record each risk’s likelihood, impact, existing safeguards, treatment, owner, and due date.
Review risk acceptance decisions and confirm approval by the appropriate authority.
Review security objectives, metrics, management reviews, and improvement actions.
Create or update policies and procedures for all identified control gaps.
Obtain required policy approvals and record employee acknowledgements.
Set a review schedule and owner for each policy and procedure.
Verify that policy language matches actual operating practice.

6. Identity, workforce, and endpoint controls

Inventory identity providers, directories, privileged accounts, service accounts, and authentication integrations.
Test MFA, SSO, password, session, and authentication settings against the approved baseline.
Sample new hires and verify approval, role assignment, account setup, and required training.
Sample role changes and verify access changes were approved and completed.
Sample departures and verify account disablement, access revocation, equipment return, and record retention.
Review privileged access assignments, approvals, monitoring, and periodic recertification.
Review service-account ownership, permissions, credential storage, and rotation.
Verify periodic user access reviews are completed, approved, and documented.
Inventory managed and unmanaged endpoints and identify devices without an owner.
Test device-management coverage and compliance reporting.
Verify encryption, screen lock, endpoint protection, patch status, and local administrator controls.
Review lost-device reporting, remote lock/wipe capability, and exception handling.
Review security awareness training completion and overdue follow-up.
Verify employees know how to report suspected security incidents.

7. Cloud, network, and infrastructure controls

Inventory cloud providers, tenants, subscriptions, accounts, projects, regions, and production environments.
Review cloud roles, permissions, privileged access, and separation of duties.
Review network exposure, segmentation, firewalls, remote access, and administrative interfaces.
Review secure configuration baselines for cloud resources, servers, databases, and network devices.
Verify encryption for sensitive data at rest and in transit.
Review secrets storage, access, rotation, and exposure monitoring.
Verify security logging is enabled for critical systems and administrative activity.
Verify logs are protected, retained, reviewed, and escalated when alerts fire.
Review configuration changes for approval, testing, implementation, and rollback records.
Review patching and vulnerability-remediation records for infrastructure.
Verify backup coverage, access restrictions, retention, and monitoring.
Select critical systems for restoration tests and record the results.
Track cloud and infrastructure exceptions through approval, review, and closure.

8. Application and software-development controls

Inventory applications, APIs, repositories, build systems, deployment pipelines, and application owners.
Review application architecture, data flows, trust boundaries, and sensitive-data handling.
Review authentication and authorisation design for key applications.
Verify repository access, branch protections, code review, and change approvals.
Review CI/CD permissions, production deployment access, and separation of duties.
Verify secrets are stored and managed through approved processes.
Review dependency inventory, vulnerability alerts, and remediation records.
Review secure-development standards and developer security training.
Review application security testing, issue triage, and release gates.
Select representative applications and APIs for security testing.
Document tested applications, test dates, results, findings, and remediation owners.
Retest corrected findings and record closure evidence.

9. Vulnerability assessment and penetration testing

Confirm written authorisation, target list, test windows, contacts, and stop conditions.
Validate the external asset inventory against approved company records.
Identify exposed services and confirm asset ownership with the company.
Conduct agreed vulnerability assessments of authorised assets.
Review scan coverage, credentials, schedules, severity ratings, and exception handling.
Validate significant findings and remove false positives from the remediation queue.
Conduct the authorised penetration test against the agreed applications, APIs, infrastructure, or cloud environment.
Record findings with affected asset, business impact, evidence, severity, and remediation guidance.
Notify the company through the agreed escalation process for urgent findings.
Create remediation tickets and assign owners and due dates.
Retest completed fixes and record results.
Update the risk register and control status based on testing results.

10. Vendor and third-party risk

Identify critical vendors and the systems and data each can access.
Assign vendor criticality based on data sensitivity, access, and business dependency.
Collect and review vendor security documentation and assessment evidence.
Record vendor risks, unresolved issues, approvals, and remediation commitments.
Verify security requirements are addressed in relevant contracts and service agreements.
Review vendor access, data-sharing, and integration permissions.
Set reassessment dates based on vendor criticality and changes.
Review vendor incidents and material changes for security impact.
Verify access and data are addressed when a vendor relationship ends.

11. Privacy, AI, and data governance

Maintain a record of sensitive data, processing purposes, locations, recipients, and retention periods.
Review data-handling procedures, deletion, access, and retention controls.
Review privacy requests, complaints, and escalation workflows where applicable.
Inventory AI systems and AI-enabled features, owners, data inputs, outputs, and vendors.
Assess AI use cases for privacy, security, human oversight, accuracy, and transparency risks.
Map applicable AI requirements to controls, owners, evidence, and review frequency.
Track AI-related exceptions, risk decisions, and corrective actions.
Review data-sharing and model-provider terms for relevant AI uses.

12. Incident response and business resilience

Review incident-response policy, severity definitions, roles, and escalation paths.
Verify security monitoring alerts are assigned and investigated.
Review incident records for response time, decisions, communications, and follow-up actions.
Confirm contact lists and notification procedures are current.
Conduct an incident-response tabletop exercise with agreed stakeholders.
Record exercise scenario, decisions, gaps, action owners, and completion dates.
Review business continuity and disaster recovery plans for critical services.
Verify recovery priorities, dependencies, recovery objectives, and communications.
Conduct or review backup restoration and recovery tests.
Track resilience findings and verify corrective actions.

13. Customer assurance and audit readiness

Create a controlled repository of approved customer-facing security evidence.
Prepare an evidence-backed answer library for common security questionnaires.
Assign an owner and approval workflow for questionnaire answers.
Review each answer for accuracy, scope, date, and supporting evidence.
Prepare an audit evidence index mapped to framework requirements and controls.
Verify evidence is complete, current, and accessible to authorised reviewers.
Track auditor or customer requests, owners, deadlines, and submitted evidence.
Record open audit findings and link each to remediation actions.
Prepare an executive summary of assessment results, progress, and material risks.

14. Findings, remediation, and retesting

Validate each finding with the responsible system or process owner.
Record the affected control, system, framework requirements, evidence, and business impact.
Assign severity, accountable owner, corrective action, and target date.
Review remediation priorities with management.
Track accepted risks with rationale, approver, review date, and expiration.
Verify completed remediation using evidence or retesting.
Update the finding status and linked control and framework records.
Escalate overdue high-priority items and record management decisions.
Produce a final prioritised remediation plan.

15. Reporting and program handover

Deliver the final system, asset, data-flow, and vendor inventories.
Deliver the complete framework-to-control mapping and applicability register.
Deliver the control library, evidence register, and test results.
Deliver technical assessment and penetration-test reports.
Deliver the risk register and remediation tracker.
Deliver policy and procedure updates.
Deliver vendor, privacy, AI, incident-response, and resilience records.
Deliver the audit evidence index and approved customer assurance materials.
Present the executive readout and review key findings with management.
Assign an ongoing owner and review cadence to every control and action.
Confirm the client’s access to all final records, trackers, and evidence.
Record the handover date, open actions, owners, and next review dates.

16. Ongoing operating cycle

Monthly

Review new assets, systems, vendors, and personnel changes.
Review critical control failures, overdue evidence, and overdue remediation.
Review vulnerabilities, significant configuration changes, and security incidents.
Review access changes, device compliance, backup status, and training completion.
Publish the monthly status report and escalate required decisions.

Quarterly

Test a risk-based sample of controls and collect fresh evidence.
Conduct and document user-access reviews.
Reassess critical vendors and open vendor findings.
Review risk-register changes and accepted risks.
Review remediation effectiveness and retest selected closures.
Present the quarterly security and compliance review to management.

Annually and when material changes occur

Refresh the enterprise risk assessment and system inventory.
Reassess framework applicability and update requirement mappings.
Review and approve security policies and procedures.
Refresh incident-response and resilience exercises.
Review material changes to business operations, technology, data, vendors, and AI use.
Update the testing plan and next-year security improvement roadmap.

3. CyberReady 360™ Service Tiers & Pricing

The prices below are indicative CHF fees for the CyberReady 360™ consulting service. The first-year fee covers the agreed setup and service scope; renewal covers the ongoing activities specified in the proposal. Software subscriptions and independent audit or certification fees are separate. Travel and accommodation for onsite work are charged separately.

Tier	First-year price	Renewal price	Typical client profile
Low — Lean	CHF25,000–CHF35,000	CHF15,000–CHF20,000/yr	1–25 employees; one legal entity; one main product/security boundary; one cloud environment
Middle — Growth	CHF60,000–CHF120,000	CHF50,000–CHF90,000/yr	26–150 employees; 2–5 distinct products; multiple teams or environments; growing vendor and customer-review workload
High — Complex	CHF150,000–CHF300,000+	CHF120,000–CHF240,000+/yr	151–500+ employees; multiple entities, regions, cloud environments, regulated operations, or complex product boundaries

The first year covers the discovery, inventory, assessment, evidence, reporting, and review activities specified in the proposal. Every tier includes an applicability review of the complete framework catalog. The detailed framework mapping, evidence work, testing, and ongoing support are scoped to the client’s applicable requirements and service tier.

Scope assumptions behind each tier

Lean: Up to 25 employees, one entity, one main product boundary, one cloud environment, and a relatively simple technology stack. Budget roughly 100–160 consultant hours in year one.
Growth: Up to 150 employees, several products or environments, and more extensive access, vendor, and evidence workflows. Budget roughly 300–500 hours.
Complex: Larger or regulated operations with multiple locations, entities, and technical environments. Budget roughly 800–1,300+ hours.

These indicative ranges provide an initial budget guide. MECi confirms the final fixed fee after agreeing the client’s scope, deliverables, and service cadence.

Pricing is quoted in CHF. The listed amounts are indicative service fees; the final proposal depends on the agreed scope, organisation size, number of distinct products and technical environments, applicable requirements, and level of ongoing support.

Third-party audit or certification fees, software subscriptions, penetration testing, and hands-on remediation are excluded unless explicitly listed in the proposal.

What would move the price

Employees and endpoints: More people mean more accounts, devices, access changes, training records, and control evidence.
Products: Each product is assessed separately when it has a distinct production environment, data flow, identity boundary, development process, or control set.
Systems and cloud environments: Number of cloud tenants/accounts, production environments, applications, repositories, identity systems, and integrations drives assessment and monitoring effort.
Applicable requirements: Mapping the full catalog is included in every tier. Distinct, applicable control requirements—particularly intensive regulatory or authorisation obligations—drive additional testing and evidence work.
Vendors and locations: More critical vendors, legal entities, countries, and data-handling arrangements increase assessment and follow-up work.
Starting maturity: Working controls and organised evidence cost less to validate than missing policies, manual processes, and unresolved technical gaps.
Testing and service cadence: More applications tested, more frequent control checks, faster remediation support, and shorter reporting deadlines increase the fee.
Revenue: We don’t price as a percentage of revenue. We use revenue as a complexity guide—for example, whether the company has enterprise customers, higher liability, or more demanding contractual obligations—not as the main calculator.

Our service fees are distinct from the client’s software licenses and external CPA or certification-body fees.

Request a CyberReady 360™ scope and pricing review.

Request a CyberReady 360™ Scope & Pricing Review →

4. Frequently Asked Questions

What is MECi CyberReady 360™?
MECi CyberReady 360™ is a cybersecurity and compliance advisory program combining a structured review, a technical and control inventory, and scoped follow-up support.

Does every framework in the inventory apply to every client?
No. MECi reviews the inventory to identify requirements relevant to the client’s business, locations, contracts, products, and systems.

How is the price determined?
Pricing is in CHF. The quote is based on the agreed scope, including organisational size, distinct products and environments, applicable requirements, and level of support.

Does the program itself provide certification?
Yes. MECi arranges independent audits and certification through specialist audit firms and certification bodies. The appointed third party conducts the audit and issues any certification; MECi coordinates the engagement. The applicable standard, scope, fees, and deliverables are confirmed in the proposal.