Most organisations know their security has gaps but not where they are. Former employees still have active accounts, several people share one administrator password, the website runs plugins that were never updated, and backups sit on the same server they are meant to protect. Customers, auditors and banks now ask how you protect data, and a general reassurance is no longer enough.
Kemlat starts with an assessment, and nothing is tested before the scope is agreed. Together we define which systems are included, then specialists from our partner network review access, settings and exposure, and test only what you have authorised in writing. You receive findings ranked by risk and explained in plain words. We then help apply the fixes, known as hardening, and check that they work.
How we work
- 01
Define the scope
We agree which systems, websites, networks and cloud accounts are included, which checks are allowed and when they may run. Testing starts only after written authorisation from your organisation.
- 02
Review access and settings
Specialists review user accounts, administrator rights, password and two-step login policies, server and cloud settings, backups and update levels.
- 03
Test exposure
Within the authorised scope, they scan for known weaknesses and, where agreed, carry out controlled attempts to get in the way an attacker would, known as penetration testing. Tests are planned to avoid disrupting your work.
- 04
Report and rank findings
Each finding is explained in plain words with its risk level, evidence and recommended fix. A short summary for management accompanies the technical detail.
- 05
Plan and apply hardening
We turn the findings into a plan of fixes with owners and priorities. Where agreed, we apply fixes such as closing old accounts, tightening settings and updating software, then re-check each fixed item.
What you receive
Assessment scope and authorisation
A written scope listing the systems included, the checks allowed and when they run, signed by your organisation.
Specialist findings report
Findings ranked by risk, each with evidence and a clear recommendation, plus a summary for management.
Plan of fixes
A prioritised list of fixes with an owner for each, so the most serious risks are handled first.
Follow-up check
A re-test of the fixed items, with an updated status for every finding.
What changes for you
- You know where your security gaps are within the agreed scope and which ones matter most.
- Old accounts, shared passwords and weak settings are found and corrected through the plan of fixes.
- You can show customers and auditors a documented review and the actions taken.
- Security improves through a planned list of fixes rather than reactions to incidents.
Where this service sits in the KEMLAT Method
Scope: This service starts with an assessment, and the scope of testing and fixes is agreed in writing before work begins. It does not include legal advice or formal certification, and fixes that need changes to application code are agreed separately.
Questions clients ask
Will the testing disrupt our systems?
Tests are planned with your IT team, and any check that could affect performance runs at an agreed time or on a copy of the system. Nothing outside the written scope is tested.
Who carries out the review?
Specialists from Kemlat's partner network with security assessment experience, coordinated by Kemlat. Everyone involved works under confidentiality terms, and their access is removed when the work ends.
Does this make us compliant with the data protection law?
The assessment shows how well your systems protect data, which supports your duties under Jordan's Personal Data Protection Law of 2023. Compliance also involves legal and procedural steps, so confirm your obligations with a legal adviser.
What happens after the report?
You decide which fixes to make. Kemlat can apply the agreed fixes, support your IT team while they apply them, or run a follow-up check once they are done.
How often should the assessment be repeated?
After major changes such as a new system, a migration or an incident, and periodically as your systems change. The report suggests a suitable interval based on your risk.
Related services
All servicesStart with a conversation
Tell us where you are today. We will suggest the right first step, with no obligation.