Problem
We are spending on security without a strategy.
We cannot show a regulator a coherent plan.
We do not know our biggest risks.
Outcomes
- Investment aimed at the biggest risks
- A plan that passes due diligence
- A clear view of exposure
Scope
In scope
- Risk and control review
- Strategy and roadmap
- Prioritised recommendations
Not included
- Hands-on implementation of controls, which sits under security architecture and engineering
- Penetration testing
Governance, risk and compliance
Customers, regulators and auditors increasingly ask for evidence that security is managed. We build the policies, risk registers and control frameworks that answer them, mapped to the standards and obligations that apply to you, and kept proportionate to your size.
- Security policy set.
- Risk register and risk treatment process.
- Control mapping to standards such as Cyber Essentials, ISO/IEC 27001 or sector rules, where they apply.
- Support with due-diligence questionnaires and tenders.
Approach
Discovery
We agree the services and data you most need to protect, and review your current controls and obligations.
Delivery planning
We prioritise by risk and set out a roadmap, costs and the controls to put in place.
Build and test
We produce the strategy and artefacts and test them against real threats and your obligations.
Operational readiness, hypercare and closure
We hand over, support the first weeks of use, and confirm the outcome before we close.
Deliverables
Technologies
Controls
Frequently Asked Questions
Is this a penetration test?
No. This is the strategy and roadmap that decides where testing and controls should focus.
Will this pass procurement and audit?
It is written to be read by procurement and auditors, with the evidence they expect.
Ready to scope this?
Tell us what you are trying to protect and we will help you plan it around real risk.