Service
Cybersecurity & Governance
Know your real risks and fix them in the right order.
The problem
If this sounds like you
- “We have passed audits, but nobody can tell me our real risks in order.”
- “A customer has sent a security questionnaire and we are not sure how to answer it.”
- “Our plants run systems that IT does not own and nobody patches.”
- “Staff are using AI tools with company data, and we have no rules for it.”
What we do
Security governance from assessment to ongoing advice.
We assess where you stand, write the policies and controls you need, get you ready for standards and audits, and stay on as advisers if you want us to.
The work covers offices, plants and suppliers. It is led by someone who has carried this responsibility for a manufacturing group, so the advice accounts for production, budgets and the people who must live with the controls.
We prepare you for certification. We do not certify: only an accredited body can do that.
What it covers
Thirteen offerings, and the event that usually triggers each.
Leadership and assurance
Ongoing security leadership on retainer
Usually starts when: you are too small for a full-time chief information security officer, and too exposed to have none.
A senior security lead who sets priorities, reviews decisions and briefs your leadership on a regular rhythm.
Audit readiness
Usually starts when: a certification, a customer audit or a regulatory review is coming.
We run the audit before the auditor does, and close the gaps in order.
Monitoring-provider governance
Usually starts when: you pay for security monitoring and cannot tell whether it works.
We check what your provider actually watches, test that alerts reach someone who acts, and set measures you can hold them to.
Security architecture review
Usually starts when: a cloud move, a core-system programme or an acquisition is planned.
We review the design before money is committed, and list the changes that are cheapest to make now.
Standards and law
ISO 27001 readiness
Usually starts when: a customer or an export contract demands it.
We prepare your policies, controls and evidence. We prepare you; an accredited body certifies.
DPDP Act readiness
Usually starts when: Indian data protection obligations apply to the personal data you hold.
We map the personal data you hold on employees, customers and suppliers, find the gaps, and set up the notices, records and processes you need.
Plant and operational-technology security assessment against IEC 62443
Usually starts when: a customer audit, or an incident at a plant.
We assess plant networks and control systems against IEC 62443, the standard for industrial security, and rank what to fix first.
Resilience
Ransomware readiness
Usually starts when: a peer in your sector was hit, and the board asks whether you are exposed.
We work through how an attack would spread, whether your backups would survive, and who decides what in the first hours.
Vulnerability management across IT and plant systems
Usually starts when: there are unpatched plant systems that nobody owns.
One list of weaknesses across office and plant systems, with an owner and a date against each. Technical testing is delivered through specialist partners, as described below.
Identity and access governance
Usually starts when: an audit finds privileged accounts, or accounts that belong to nobody.
We clean up who can reach what, and set joiner, mover and leaver rules that hold.
People and suppliers
Third-party risk programme
Usually starts when: a supply-chain breach happens, or a customer sends you a vendor questionnaire.
A simple way to rank suppliers by risk, ask the right questions and follow up on the answers.
Awareness and phishing simulation
Usually starts when: a phishing email works.
Short, practical training and simulated phishing emails, tracked over time.
Between two pillars
AI governance and acceptable use
Usually starts when: employees are already pasting company data into public AI tools, and there is no policy, no control and no data boundary.
We put in place a policy, the controls behind it, training for staff and a clear boundary for which tools may touch which data. It is delivered in weeks.
Technical testing
Penetration testing and vulnerability assessment
Where testing is needed, we bring in qualified specialist testers, set the scope, oversee the work and turn the findings into a fix plan you can act on.
You are told before any third party touches your systems. Testing is an optional add-on, scoped separately.
Before we start
What must be true first
If these are not in place, this may not be the right time. We would rather say so on the first call.
- Someone in leadership owns the outcome. Without a named owner, findings stay in a report.
- We can speak to the people who run IT and the plants, and see current documents and configurations.
- You are ready to fix things in order. If you need a certificate next month, we will tell you plainly whether that is realistic.
- You are not in the middle of an incident. If an attack is under way, you need an incident response team first. Call us after.
Matching entry offer
Security & Governance Review
1–2 weeks, fixed scopeYou get: A risk register, your top gaps, a prioritised fix plan and a leadership briefing. Quoted after the first call. The written outputs are yours.
Talk it through with someone who has run it.
Thirty minutes. We will tell you plainly whether this is the right first step.