We built the tool we kept wishing we had.
GUUT Technologies is a cybersecurity consultancy. We have run enterprise risk assessments for financial institutions, and the work kept ending the same way: in a spreadsheet.
Where Zikomo comes from: a completed assessment, kept by hand.
Why it exists
The assessment was rigorous. The artefact was a file.
A comprehensive enterprise risk assessment: forty risks, thirty-three columns, every stage of ISO 31000 represented, controls mapped to Annex A. Real work, done properly.
Then a year of edits by six people. Seventeen of the forty rows had a calculated field overwritten by a paste, so their priority could not be verified from the file, and every one still displayed as Priority 1. Twenty-seven of the forty were marked Accept with no budget allocated, and the document had no way to say so.
Nobody had been careless. That is simply what a spreadsheet does when it governs a bank's security posture. The gap assessment and the risk assessment were also kept apart, joined by hand every single time, and there was no way to compare this year against last.
How we work
The frameworks our practice works to.
The process, and the words for it
Risk management principles and the five-stage process: identification, analysis, evaluation, treatment, and monitoring through to acceptance.
Not certifiable, deliberatelyInformation security risk, specifically
How that process runs inside an ISMS. Asset-based and event-based identification, and the qualitative, semi-quantitative and quantitative analysis choice.
The standard an auditor expects namedAnnex A, both 2013 and 2022
The control catalogue. 114 controls in 14 domains, and 93 in 4 themes, with the mapping between them.
Both supported, client choosesTechniques, chosen to fit the question
The catalogue of assessment techniques that sits alongside ISO 31000. Frequently miscited as ISO 31004, which is something else.
Companion to ISO 31000These are the standards the practice works to. Naming them is not a claim that GUUT or Zikomo holds certification against any of them.
How engagements run
Facilitated, not delegated.
We propose. Your people confirm. That is not a service-design preference, it is what the standard requires.
ISO 27001 clause 6.1.2 requires the organisation to identify risk owners, and clause 6.1.3 requires those owners to approve the treatment plan and formally accept the residual risk. A consultant cannot accept residual risk on a client's behalf. If we scored and signed everything, the assessment would not conform to the standard it claims to follow.
So the consultant drafts, normalises across departments and challenges the numbers. The bank's own heads of function confirm or dispute them, and the Chief Risk Officer signs. The platform is built to make that division of labour explicit rather than convenient to skip.
Company detail
The particulars.
| Registered name | [GUUT to supply] | ||
| Company number | [GUUT to supply] | ||
| Registered office | [GUUT to supply] | ||
| Data protection contact | [GUUT to supply] | ||
| General enquiries | [GUUT to supply] |
Left blank deliberately. Filling these with plausible text would be inventing a company record, and this is a page about keeping records honest.
assessment
Bring us a real assessment.
Not a sample. The register you actually keep. We import it, recompute it, and tell you plainly what it can and cannot prove.