Working together · Where to start
CISO Baseline Review: the right level of security for your business
A short, fixed-scope review that tells you how much security your business needs, where the gaps that matter are, and the order to tackle them in. Without being sold anything you do not need.
Who it is for
Is this you?
- Boards and owners who are not sure whether their security is in proportion to the business
- Firms facing a trigger: an insurance renewal, a customer questionnaire, a regulator's question or an audit finding
- IT teams that run the systems well and want an independent view of priorities to take to the board
- Firms deciding whether they need ongoing support, and which kind
Available through Foundation Advisory
What you get
What is included
Your level, in plain language
Which parts of your business are the shed, the house and the bank vault: what you are protecting, and what a week without your main systems would cost.
What you already have
A review of the controls you already pay for, read-only wherever possible, so gaps can often be closed without new spend.
The gaps that matter
The handful of gaps that carry real risk for your business, set against what your customers, insurers and regulators expect to see.
The order to tackle them in
A prioritised list with the first steps your team or provider can take straight away.
A short written summary
Written for the board, not for engineers. It is yours to keep, whatever you decide next.
An honest recommendation
Whether you need ongoing help, and if so whether Foundation or Advisory fits. Sometimes the answer is that you do not.
How it works
From first conversation to results
A first conversation
We agree what the review covers, who we need to speak to and what read-only access helps.
Review
We look at what you are protecting, what an outage would cost and what you already have in place, focusing on identity, access and governance.
Findings
We walk you through the summary: your level, the gaps that matter and the order to tackle them in.
Your decision
You decide what happens next. There is no obligation to take any further work.
What this is not
- It is not a penetration test or a certification audit. It sets your level and your priorities.
- We do not sell products or take commissions, so the recommendations are not shaped by anything we would gain.
- It does not lock you in. The summary and findings are yours whatever you decide.
Related thinking
Read more
The breach you can't patch: JLR one year on
Most firms hit by the JLR attack were never breached. Customer concentration, cash runway, contracts and insurance: the board's exposure test.
Infographic · Governance and riskDon't be the easiest door on the street
Interactive guide for small and medium-sized firms: what a passing attacker sees, and how to look less inviting.
Top 10 · Governance and riskCyber Resilience Planning: Top 10 Actions for Boards
What every board should make sure is in place before a cyber incident.
Questions
Common questions
How long does it take?
That depends on the size of your estate and is agreed at the first conversation, before any work starts.
How is it priced?
As a fixed price, agreed up front once we know the scope. You receive it in writing before anything starts.
What access do you need?
Read-only access wherever possible, for the time the review takes, and conversations with whoever owns IT and cyber risk.
What happens after the review?
Some firms act on the findings themselves. Others continue with Foundation or vCISO and advisory. The recommendation will say which, if either, fits.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation