Cyber & Risk
Cyber risk translated into decisions the business can make.
You do not have a cyber problem so much as a prioritisation problem: a long list of things that could be improved and no agreed order. We assess where you genuinely stand, express it as business risk rather than a tool report, and give you a plan that fits your budget and your team.
Recognise any of this
Signals this is your problem.
- 01
Your cyber insurance renewal asks questions nobody in the business can answer.
- 02
Security has been delegated to whoever is most technical, alongside their real job.
- 03
You have tools (MFA, endpoint protection, backups) but no evidence they are working everywhere.
- 04
There is no written answer to "what do we do in the first hour of a breach".
- 05
The board wants a risk position and gets a screenshot of a dashboard instead.
The work
What the engagement actually involves.
Posture assessment
A structured review of identity and access, endpoints, email, backup and recovery, third-party access, and the joiner-mover-leaver process. We map findings against recognised baselines, the ACSC Essential Eight, NCSC Cyber Essentials themes, and relevant ISO/IEC 27001 controls, so you know which recognised bar you currently clear.
Risk register the board can read
Findings become a ranked register: what could happen, how likely, what it would cost you, what it costs to reduce, and who owns it. Written in business language so a non-technical director can chair the conversation.
Policy and governance that fits
A proportionate set of policies (acceptable use, access control, data retention, supplier security, incident response) sized for your headcount. Enough to satisfy a client audit, short enough that people read them.
Incident response readiness
A one-page response plan naming who decides, who communicates, who to call, and what your legal notification clocks are under UK GDPR and the Australian Notifiable Data Breaches scheme. Then we walk your leadership team through a tabletop exercise so the first time you use it is not during a real incident.
Third-party and supply-chain review
An inventory of who has access to your systems and data, what each supplier is contractually obliged to do about security, and where your exposure sits if one of them is breached.
Deliverables
What you are left holding.
Documents you own, in formats you can hand to a board, an insurer, an auditor or your next hire, not slides that expire when the engagement does.
- 01Security posture assessment mapped to the Essential Eight, Cyber Essentials themes and relevant ISO/IEC 27001 controls
- 02Ranked business risk register with owners, cost of mitigation and target dates
- 03Proportionate policy set sized to your organisation
- 04One-page incident response plan plus a facilitated tabletop exercise
- 05Supplier and third-party access inventory with contractual gaps flagged
- 06Board-ready summary: current position, priorities, and what changes next quarter
Straight answers
Questions we get asked.
Can you certify us to ISO 27001 or Cyber Essentials?
No. Certification is issued only by an accredited certification body or, for Cyber Essentials, a licensed certifying body. Our work is advisory and readiness: we get your controls, evidence and documentation into the state an assessor expects, and we will tell you honestly how far from that bar you are. The assessment itself stays with the independent certifier.
Do you do penetration testing?
We scope it, commission it from specialist testers, and translate the report into a prioritised remediation plan. Keeping the tester independent of the adviser who wrote your controls is deliberate, it keeps both opinions honest.
How long does an assessment take?
For a business under roughly 200 people, typically two to three weeks from kick-off to the board summary, including interviews and evidence review. Larger or multi-entity groups take longer, and we will say so before you commit.
