Cyber Governance
Board-level accountability for cyber risk: governance, oversight and regulatory readiness.
Cyber risk is rising; boards are increasingly accountable for it. NIS2 and DORA make senior leadership accountable, and the UK Cyber Security and Resilience Bill widens the types of organisations caught. Most boards have only ever had a technical briefing. That is not governance.
We give boards the business-facing view they need: who owns the risk, how it is overseen, whether incident response will hold, and where suppliers create exposure. We work independently, or alongside your CISO, CIO or CTO where useful. We bring the governance and regulatory perspective to sit alongside their technical expertise, and joining up cyber with privacy, AI and data governance rather than treating them as standalone functions.
Our cyber work covers regulatory and governance advice; not penetration testing, technical security assessment, or managed security services.
Founder-led, drawing on board-level governance experience at a FTSE 100 organisation and senior roles in US technology; we advise from the perspective of the leaders who carry the accountability.
We work the way you need us to: as ongoing advisers while regulation and your cyber risk evolve; as consultants on defined projects; or as fractional cyber governance, owning the regulatory and governance layer of the CISO function on a retained basis for organisations that already have technical security covered.
What we do
Three services; commission one on its own, or combine them into a broader cyber governance programme:
Board workshops and tabletops
Two formats for boards and senior leadership teams. The workshop gives your board the governance picture it needs: the regulatory frameworks that apply to you, where accountability sits, and potential gaps. The tabletop is a facilitated scenario where the board walks through a simulated cyber incident, testing decision-making, accountability and escalation in a realistic, constructive environment.
Book individually or as a sequence.
Find out more: Board workshops and tabletopsKYData Cyber Governance
The cyber module of our KYData (Know Your Data) audit: an independent review of your internal cyber governance arrangements, tested against the standards relevant to your sector. It covers roles, reporting lines, board oversight, incident response plan governance, policy architecture, and readiness against NIS2, DORA and the UK Cyber Security and Resilience Bill.
Commission it on its own, or alongside KYData Privacy and KYData Governance; run together, the findings show where privacy and cyber overlap and where the gaps between them create risk.
Find out more: KYData Cyber GovernanceThird-party cyber risk
A review of how your organisation really governs supplier cyber risk. Many TPRM processes sign off supplier risk on the basis of policies or certifications being in place; that shows a process was followed, not where you stand. We focus on your business-critical suppliers: the real risk exposure, how suppliers are tiered, and the likely impact on business continuity; alongside readiness against the supplier obligations in NIS2, DORA and the UK Cyber Security and Resilience Bill.