Working together · Board
Independent cyber oversight for your board
Boards are accountable for cyber risk but rarely have someone round the table who can test what they are told. We provide independent, board-level challenge on cyber security, data protection and technology risk, as an adviser or as a non-executive director (NED).
Who it is for
Is this you?
- Boards and risk committees that want independent challenge on cyber risk, separate from the people who run IT
- Firms that need a director with cyber and data protection expertise
- Chairs who want board members briefed and able to ask the right questions
- Firms preparing for regulatory scrutiny of operational resilience and data protection
Available through Advisory
What you get
What is included
Independent challenge
Someone with no stake in the answer, who asks the questions management may not want asked and tests the evidence behind the reassurance.
Board briefings
Short, practical sessions that help directors understand their firm's cyber risk and their own responsibilities.
Oversight against the frameworks that apply
Oversight against UK GDPR, operational resilience expectations, ISO 27001 and NIST, and DORA where your firm sits in an EU financial supply chain.
Balance between innovation and risk
A clear view on AI, cloud and operational technology decisions, so the board can say yes with its eyes open.
Board and advisory panel experience
Experience on boards and advisory panels across several sectors, applied to how your board actually works.
How it works
From first conversation to results
Conversation with the chair
We discuss what the board needs: an adviser, a formal non-executive role, or a defined review.
Agree the terms
Scope, time commitment, independence and any conflicts are agreed in writing.
Attend and challenge
Attendance at board or committee meetings, with papers reviewed in advance.
Report
Regular written views to the chair or committee on where the firm stands.
What this is not
- We will not act as a non-executive director for a firm where we also provide paid advisory work that the board would oversee. Independence comes first.
- Board advisory does not replace management's responsibility to run security day to day.
Related thinking
Read more
Cyber Resilience Planning: Top 10 Actions for Boards
What every board should make sure is in place before a cyber incident.
Good Practice Guide · Governance and riskBoard Preparation for Cyber Incidents
A governance framework for how the board prepares for, oversees and learns from a cyber incident.
Good Practice Guide · Identity and accessBoard Member Identity Protection
Why directors and senior executives are prime targets, and how to protect their digital and physical identity.
Questions
Common questions
What is the difference between an adviser and a NED?
An adviser supports the board without being a director. A NED is a formal board member with the legal duties that come with it. We will help you decide which fits.
Can you also be our vCISO?
Not for the same firm. Overseeing work we also deliver would undermine the independence a board needs. We will recommend one role or the other.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation