Information security, proportionate to your business

Helping you build an information security management system you can actually run, and getting you ready for certification.

We start from what you already do, because most organisations are further along than they think. From there we help you set the scope, and we guide you through documenting your risks in your own register rather than writing it for you: it has to be yours, and the people who own the risks need to recognise them. We then identify which controls are missing and turn that into an actionable roadmap of implementation you can work through at a sensible pace. Where certification is the goal, we make sure you are ready for the assessment and know what to expect from it.

Helping you articulate your risks in terms your senior leadership recognises, rate them consistently, and report them so the priorities are obvious.

Risk written as "patching is poor" tells senior leadership nothing. We show you how to express each risk as what could happen, what would allow it, and what it would cost you, and we help you develop your own assessment and treatment methodology so the rating means the same thing every time it is applied. You end up with a register you maintain and a report that says what to do first, what can wait, and what you are choosing to accept, which is the part most registers leave out.

Knowing which suppliers you genuinely depend on, checking new ones properly before you commit, and knowing what happens to you when one of them has a bad week.

Most disruption now arrives through somebody else. We help you identify your critical dependencies: the suppliers and third parties whose services you could not operate without for long, so that an incident at their end becomes an incident at yours, whether or not any of your information was involved. Their information security is therefore part of your resilience, and the question rarely stops at the first tier, because your suppliers depend on subcontractors whose arrangements you can see least of. From there we help you set assurance and handling conditions proportionate to each relationship, and make the checks repeatable, so assurance is not something filed once at onboarding. For suppliers you are about to appoint, we help you carry out due diligence before you commit: whether they have adequate technical and organisational measures in place, and can evidence them, which matters most where sensitive or personal data is involved and your own obligations follow the data to wherever it is processed. We also look at the contract itself, because assurance that is never written down is difficult to rely on: the agreement should stipulate the information security requirements you expect, what happens if they are not met, and the obligation to tell you promptly when something goes wrong.

Policies written for your organisation and its size, in language your people will read once and remember.

Borrowed policies fail because they describe someone else. We write yours around how you actually operate, keep each one as short as it can be, and make sure the set hangs together rather than contradicting itself across ten documents. You end up with something you can hand to a new starter, an auditor or a customer without editing it first.

Coming to see how the work is really done, rather than assessing you on what the documents claim.

Documents describe intent; a visit shows practice. We walk the site, watch how information moves between people, systems and suppliers, and talk to the staff who do the work rather than only the people who wrote the policy. What comes back is a short list of what is genuinely exposed, ranked, with the quick corrections separated from the real projects.

Finding out what you are taking on before you sign, and what it would take to put right.

An acquisition brings someone else’s liabilities onto your balance sheet: unpatched estates, breaches nobody disclosed, personal data held without a lawful basis, contracts that commit you to controls that do not exist, and a certificate whose scope turns out to cover one office. We look before the deal closes and report plainly what is there and what putting it right would involve, so it can inform your negotiation rather than surprise you afterwards. Where a deal is already done, the same work tells you what you have bought and what to fix first.

Senior security expertise available to you as and when you need it, without the cost of the role full time. Often described as a virtual CISO, or CISO as a service.

Some organisations need judgement more often than they need a project. We hold the standing context on your business, so the conversation starts from what we already know rather than from the beginning each time. We attend the meetings where security is on the agenda, review significant changes before they are made, and pick up the questions that arrive without warning from a customer, an insurer or a regulator. The arrangement is shaped around how much support you actually need, and scaled back as your own capability grows.

Working out what actually happened after an incident, and what needs to change so the same route is not open next time.

Once systems are back up, the pressure to move on is considerable, and the lessons are usually lost with it. We come in afterwards and establish the sequence of what happened, how the access was obtained, how long it went unnoticed, and which controls did their job. The output is a clear account you can give to a customer, an insurer or your own senior leadership, and a short list of changes that would make a repeat harder. We are equally interested in near misses, which are the cheapest lessons available to any organisation.

What has happened recently in your sector, what was missing in each case, and what it means for you.

We research recent incidents among companies like yours, set out what is known from public reporting, and give our own assessment of the controls that were absent or ineffective in each. Written for senior leadership rather than a technical audience, and ending on the questions worth asking of your own organisation.