Practice 4
Information security and cyber risk
Most incidents do not begin with a breach of the perimeter. They begin with a person, a process and an access right nobody has reviewed.
The client's situation
- No clarity on where the company is exposed or who owns information security.
- Data or documents have left the perimeter and the channel has to be identified.
- Processes have to be brought in line with recognised standards.
- Management does not know what to do in the first 24 hours of an incident.
What is usually at stake
- Operations stopping and data that cannot be restored.
- A client base leak and the claims that follow it.
- Decisions in the first hours of an incident that destroy the evidence.
- Spending on protection bought without understanding the real risks.
The applicable approach
Assessment and audit
A review against recognised international information security practice, including preparation for ISO/IEC 27001 certification.
Governance
Policies, allocation of responsibility, access and supplier management — what actually determines resilience.
Awareness
Training for staff and executives: what the standard social engineering scenarios look like and what to do about them.
Incident readiness
A first-response plan, roles, evidence preservation and communication. Worked out before an incident, not during one.
Coordinating specialists
Technical work is delivered by specialist providers; we define the task, run the process and accept the result.
Format of the deliverable
- An assessment report: the risks identified, their significance and the order in which to address them.
- A set of policies and procedures sized to the company.
- An incident readiness plan with roles assigned.
- A staff training programme.
Lawful boundaries and honest wording
- We do not claim to operate our own security operations centre (SOC), penetration testing services, MDR or round-the-clock incident response: these are not confirmed competencies of the company.
- Work requiring narrow technical qualification is delivered by specialist providers, and we say so plainly.
- No programme delivers absolute protection. The goal is to reduce the probability and the cost of an incident.
FAQ
Do you run penetration tests?
Not in-house. Where one is needed we define the task, select a specialist provider and accept the result on the client's behalf.
Where should a company with nothing in place start?
With an assessment: which data and processes are critical and where they are exposed today. Buying security tools before that step usually produces cost without result.
Not sure which practice your situation belongs to?
Describe it in two or three sentences — we will tell you whether we are applicable and what the next step is.