Assessment

Secure Before You Deploy | SSAT Services

Firmus provides System Security Acceptance Testing (SSAT) services to validate that systems, applications, infrastructure, and security controls are securely implemented and meet the organization’s cybersecurity, compliance, and operational security requirements prior to production deployment or project acceptance.

Our SSAT approach focuses on identifying security weaknesses, configuration issues, integration risks, and operational gaps before systems are fully commissioned into live environments. The assessment helps organizations reduce deployment risk, improve security assurance, and validate that implemented controls function as intended.

Scope of Services

1. Security Requirements Validation

Firmus reviews and validates that security requirements defined during project planning, design, procurement, or governance stages have been properly implemented within the target environment. Assessment areas may include:

  • Security architecture requirements
  • Access control requirements
  • Logging and monitoring requirements
  • Network segmentation requirements
  • Hardening standards
  • Regulatory and compliance requirements
  • Secure integration requirements
  • Backup and recovery requirements

2. Security Configuration Review

Our consultants assess the security configurations of systems, infrastructure, applications, and network components to identify misconfigurations and security weaknesses. Assessment areas may include:

  • Operating system hardening
  • Firewall and network security configurations
  • Active Directory and identity management settings
  • Endpoint security controls
  • Cloud security configurations
  • Remote access security
  • Database security configurations
  • Security monitoring configurations

3. Vulnerability Assessment & Security Testing

Firmus performs security testing to identify vulnerabilities and validate the effectiveness of implemented security controls within the target environment. Testing activities may include:

  • Vulnerability assessment
  • Security baseline validation
  • Network security testing
  • Web and application security testing
  • Access control validation
  • Authentication and authorisation testing
  • Patch management verification
  • Secure communication validation

4. Integration & Operational Security Validation

The assessment validates that interconnected systems, third-party integrations, and operational workflows are securely implemented and do not introduce unacceptable cybersecurity risks. Areas may include:

  • System-to-system integrations
  • OT/IT connectivity validation
  • Third-party/vendor connectivity review
  • Secure remote access validation
  • Data flow security review
  • Logging and alerting integration checks

5. Risk Assessment & Remediation Guidance

Firmus provides detailed findings, risk ratings, and prioritized remediation recommendations to support project stakeholders in addressing identified security issues prior to go-live or acceptance.

Methodologies & Standards

  • ISO/IEC 27001

  • NIST Cybersecurity Framework

  • CIS Benchmarks

  • OWASP Testing Methodology

  • IEC 62443 (for OT/industrial environments)

  • Regulatory or customer-specific security requirements

Deliverables

  • System Security Acceptance Testing Report

  • Executive Summary & Risk Overview

  • Technical Findings & Risk Ratings

  • Security Configuration Review Results

  • Vulnerability Assessment Results

  • Remediation Recommendations

  • Security Acceptance Validation Summary

Benefits

  • Validate security readiness before production deployment

  • Identify security gaps and misconfigurations early

  • Reduce operational and cybersecurity risks

  • Improve assurance for project stakeholders and management

  • Support compliance and governance requirements

  • Strengthen security posture across interconnected environments

  • Enhance confidence in system go-live and operational readiness

Why Firmus?

Firmus has successfully delivered multiple OT cybersecurity consultancy and CCoP-related projects across critical and industrial environments. Our engagements are led by experienced consultants with IEC 62443 certifications, enabling us to provide practical, standards-aligned guidance in securing OT and industrial control system (ICS) environments while supporting regulatory and operational cybersecurity requirements.

Firmus is also recognized through multiple industry-leading certifications and accreditations, including:

  • CREST Accredited Company with CREST Certified Consultants

    Firmus is CREST accredited, validating our capabilities, methodologies, and quality standards in delivering professional cybersecurity assessment and penetration testing services aligned with internationally recognized best practices.

  • ISO/IEC 27001:2022 Certified

    Firmus is certified to ISO/IEC 27001:2022, demonstrating our commitment to maintaining a robust Information Security Management System (ISMS) and protecting the confidentiality, integrity, and availability of information assets.

  • Cyber Trust Mark — Advocate Level Certification

    Firmus is certified at the highest Cyber Trust Mark tier, demonstrating advanced cybersecurity maturity and operational excellence.