Working together · Advisory
A fractional CISO for your board
Security leadership for firms that need a Chief Information Security Officer (CISO) at board level but not a full-time hire. One named adviser who knows your estate, keeps the record straight and reports to your board in plain language.
Who it is for
Is this you?
- Regulated firms of roughly 500 to 2,000 people, in financial, legal and professional services
- Boards that are asked about cyber risk by regulators, insurers or clients, and need someone to own the answer
- IT teams that run the systems well but have no one setting security direction or speaking for it at board level
- Firms that have outgrown ad hoc advice but cannot justify, or cannot find, a full-time CISO
Available through Advisory
What you get
What is included
A named fractional CISO
The same person every time, who learns your estate, your people and your regulators. Not a rota, not a ticket queue.
A live risk register
Every material cyber risk recorded with an owner, a score, a treatment decision and a review date, kept current rather than refreshed once a year.
A documented decision trail
Each recommendation is logged with the decision your firm took and who took it. When an auditor, regulator or insurer asks why, the answer is already written down.
Board reporting
Regular, plain-language reporting on where you stand, what has changed and what the board needs to decide. Written to be read by directors, not engineers.
Policies that match reality
A security policy set that describes how your firm actually works, maintained as things change.
Supplier and incident readiness
Help with supplier security questionnaires and due diligence, and an incident plan your team has rehearsed.
How it works
From first conversation to results
Diagnose
We start with a short diagnosis of identity, access and governance, using what you already have in place.
Agree the priorities
Together we set the first-year priorities and record them in the risk register, with owners and dates.
Work the plan
Regular working sessions with your IT team or provider, and a standing slot with whoever owns cyber risk on the board.
Report and review
Board reporting on an agreed cycle, and a review of the register whenever your business, systems or regulators change.
What this is not
- We do not run your systems or your security tools. Your IT team or provider does the work; we set direction and check it is done.
- We do not sell or resell products, and we take no commissions. If we recommend something, it is because you need it.
- The service is advisory only. Decisions stay with your firm, and our professional indemnity cover is set up on that basis, in the same way as an accountant or solicitor.
Related thinking
Read more
Board Preparation for Cyber Incidents
A governance framework for how the board prepares for, oversees and learns from a cyber incident.
White paper · Governance and riskThird-Party and Supply Chain Ransomware
Attack vectors, kill chains and resilience for organisations that rely on outsourced IT, facilities and software suppliers.
Guide · Governance and riskFrom STRIDE to MITRE ATT&CK
Six-step method from data flow diagram to a scored, owned risk register, with a worked Conditional Access example.
Questions
Common questions
How is this different from a managed service provider (MSP)?
An MSP that runs your security and then reports on how well it works is marking its own homework. We only advise, so our view of your risk is not shaped by anything we operate or sell.
How much of our time does it take?
That is agreed up front and depends on how much you want us to carry. Most of the effort sits with us; your side is decisions, access to the right people and a regular slot with the board.
Can we start smaller?
Yes. Many firms start with Foundation, which keeps the baseline in order, and add advisory support when they need it.
How is it priced?
Pricing is agreed after the diagnosis, once we understand your estate and what your regulators expect. You receive a written proposal with exactly what is included.
Start with a conversation
Tell us about your organisation, your regulators and what is worrying you. We will say plainly whether we can help, and how.
Book a conversation