Security approach
How we practise security — for you, and for ourselves.
Frameworks
Method
Evidence
Frameworks we align to
Recognised frameworks, applied pragmatically.
- Programme
NIST CSF 2.0
NIST Cybersecurity Framework 2.0
How we use it: The backbone of our security programmes. We structure assessments and roadmaps around Govern, Identify, Protect, Detect, Respond and Recover, so leadership sees one picture of maturity and progress.
- Management system
ISO/IEC 27001 / 27002
Information security management systems and controls
How we use it: We use ISO 27001 for readiness and ISMS implementation, and ISO 27002 as the control catalogue when designing practical, auditable controls.
- Controls
CIS Controls v8
Center for Internet Security Critical Security Controls
How we use it: A prioritised, technical baseline. We use the Implementation Groups to set realistic first steps and CIS Benchmarks to harden cloud and system configuration.
- Application & AI
OWASP ASVS · Top 10 · LLM Top 10
Open Worldwide Application Security Project standards
How we use it: ASVS sets the depth of our application tests, the Top 10 frames common risk, and the Top 10 for LLM Applications guides red-teaming of assistants and agents.
- Threat-informed
MITRE ATT&CK & ATLAS
Adversary tactics and techniques for enterprise and AI systems
How we use it: We map detections, penetration-test findings and AI threat models to ATT&CK and ATLAS techniques, so coverage is measured against how attackers actually operate.
- Architecture
Zero Trust (NIST SP 800-207)
Zero Trust Architecture
How we use it: Our reference for identity-centric architecture: every user, workload and agent is authenticated, authorised and continuously evaluated, with no implicit trust from network location.
Engagement methodology
Scope → discover → test → report → remediate → retest.
- 01
Scope & rules of engagement
Targets, methods, test windows, escalation contacts and out-of-bounds systems agreed in writing before anything starts.
Week 0
- 02
Discover
Reconnaissance and asset discovery to confirm the real attack surface — often larger than the asset register.
Days 1–3
- 03
Test & assess
Manual, tool-assisted testing within scope. Exploitation is controlled; destructive techniques only with explicit approval.
1–3 weeks
- 04
Report
Risk-rated findings with evidence, business impact and remediation steps — plus an executive summary leadership can read.
Within 1 week
- 05
Remediate
We work with your engineers on fixes, prioritised by exploitability and impact.
Your timeline
- 06
Retest
We verify the fixes and issue an updated report showing what has been resolved.
1–2 weeks
What a report looks like
Written for the board and the engineer.
Your data during engagements
How we protect what we touch.
Least-privilege access
Engagement accounts are scoped to the minimum needed, time-boxed and revoked at close.
Client-owned tenancy
Where possible we work inside your environment and tooling, so data never leaves it.
Encrypted evidence storage
Evidence and findings are stored encrypted, with access limited to the engagement team.
Retention & destruction
Evidence is retained only as long as agreed, then securely destroyed — with confirmation on request.
Background-checked staff
Practitioners on security engagements are background-checked. TODO: confirm screening policy.
NDAs as standard
Mutual NDAs before scoping, and confidentiality terms in every statement of work.
Responsible disclosure
Found a vulnerability in a DataInn system or product?
Please report it privately to info@datainn.io with steps to reproduce. We’ll acknowledge your report, keep you updated, and won’t pursue good-faith research that respects user privacy and avoids disruption. Our contact details are also published in security.txt.
Want this rigour applied to your estate?
Start with a 45-minute security readiness call.