Home/Why Data Fiduciaries
Why Data Fiduciaries
An assessment is only worth what it can be relied on for. Four things decide that: who performs it, whether it produces evidence somebody else will accept, whether it fits the organization it was written for, and whether the firm performing it has anything to gain from the answer.
What decides it
Engagements are led by people who have carried executive responsibility for security programs, including interim chief information security officer engagements, rather than by analysts working from a checklist. The difference shows in what an assessment chooses to examine and in what it recommends you do first.
A security claim is worth what can be produced to support it. Every recommendation we make is aimed at the artifact an auditor, a customer, a regulator, or a court will ask to see, and at the process that produces that artifact repeatably rather than once.
Controls, sequencing, and tooling follow your product, your technology stack, and your stage of growth. A control set copied from another company's program is the most common reason a program passes an audit and still fails to reduce risk.
Assessment, roadmap, audit readiness, and reassessment sit with one firm, so nothing is lost in the handover between them. Where a standard requires an independent auditor or assessor, that work is performed by an independent firm and our role is to prepare you and represent your interests.
Every engagement runs under a nondisclosure agreement and a master services agreement, and under attorney-client privilege where counsel directs the work. Findings are written on the assumption that they may one day be read by somebody outside your organization.
Boundaries
Independence is a set of things a firm gives up. These are ours, stated plainly so you can hold us to them.
Independence and terms
Data Fiduciaries takes no revenue from tooling resale, implementation, or referral commissions, so an assessment has nothing to steer. Engagements are scoped individually and conducted under a nondisclosure agreement and a master services agreement, and under attorney-client privilege where counsel directs the work.
Questions
Yes. Where a standard requires an independent auditor or assessor, that party issues the attestation and we do not. We prepare the client, assemble the evidence, and coordinate the engagement, and we take no fee from the auditor for the referral.
No. Implementation is performed by your team or by providers you choose. Keeping implementation revenue out of the relationship is what allows the assessment behind it to be independent.
Thirty minutes on where your program stands, what is being asked of it, and what would have to be true for the answer to hold up.