Policy and risk management

The most expensive way to do security is to spend evenly on everything, driven by whatever threat last appeared in the press. Risk management replaces that waste with a disciplined decision: which assets truly matter, what threatens them, how likely and how severe it would be, and — for each risk — what you do about it. It’s not a bureaucratic exercise; it’s how you justify where you put the money and how you sleep at night.

How we work

We follow recognised standards (ISO/IEC 27005 and NIST SP 800-30):

• Context and assets — what needs to be protected, the business context, legal obligations (GDPR, NIS2, DORA, where applicable)
• Risk assessment — threat and vulnerability identification, likelihood and impact scoring, a risk register that is maintained, not abandoned after version one
• Risk treatment — the four options: treat, accept, avoid or transfer (e.g. through insurance); residual risk is formally accepted by a named individual, not “by the organisation”
• Policy framework aligned to ISO 27001 — security policy, topic-specific policies (access, cryptography, suppliers, incidents, continuity), standards and procedures people can apply
• Governance — roles and responsibilities, declared risk appetite, management review, metrics

What you get

• Risk assessment report and a maintained risk register
• Risk treatment plan and Statement of Applicability
• ISO/IEC 27001-aligned policy set, tailored to your context
• Governance structure (RACI, reporting model, risk appetite statement)
• Gap analysis and prioritised roadmap