Specialist Capability · Cyber & Risk
The cyber risk conversation your board currently isn't having.
A one-off assessment answers where you stand today. This is the ongoing version: ongoing governance, board-ready risk reporting, and compliance uplift, delivered in language your board can actually act on, not a compliance checklist that sits in a drawer.
What this covers
Governance frameworks
Establishing the cyber risk governance structure your board needs, not inheriting one. At a children's services enterprise operating across four countries, I founded and chaired the Cyber Risk Committee from scratch, reporting directly to the Board on enterprise risk and security posture.
Board-ready risk reporting
Regular, plain-English reporting that keeps technology risk a standing agenda item: the same cadence I've held presenting cyber security posture directly to the Board for a four-country children's services enterprise, and as a monthly standing item for a national accommodation provider.
Security architecture uplift
Practical uplift of your security controls, sequenced against actual risk and benchmarked against the ACSC Essential Eight and ISO 27001, informed by direct experience deploying a global Zero Trust architecture (CrowdStrike, Netskope, Cisco Meraki, KnowBe4) for a children's services enterprise, protecting 5,000+ staff across four countries.
Compliance uplift
Ongoing alignment to the Australian Privacy Act, plus PCI-DSS and GDPR where they apply to your business, including the Data Breach Playbook and live executive simulation exercises I built for a four-country children's services enterprise to pressure-test the response before you need it, not after.
Outcomes
What you can expect
Cyber risk isn't a project you finish. It's a standing responsibility. This retainer gives your board one accountable executive across strategy and risk, not a rotating cast of vendors.
- A standing cyber risk governance structure your board can rely on
- Regular, board-ready reporting instead of an annual compliance scramble
- A security architecture that improves on a sequenced, risk-ranked basis
- One accountable executive, not a rotating cast of vendors
Frequently asked questions
What's the difference between Cyber Risk Advisory and a one-off security assessment?
A one-off assessment answers where you stand today. Cyber Risk Advisory is the ongoing version: standing governance, regular board-ready risk reporting and continuous compliance uplift, rather than a single point-in-time review.
How much does Cyber Risk Advisory cost?
An ongoing retainer functioning as a fractional CISO, with a six-month minimum term. Get in touch for pricing.
What frameworks does the governance and compliance work align to?
The ACSC Essential Eight and ISO 27001 for security architecture, and the Australian Privacy Act, plus PCI-DSS and GDPR where they apply to your business, for compliance uplift.
What does the Cyber Risk Advisory retainer actually cover?
Four things: governance frameworks, board-ready risk reporting, security architecture uplift sequenced against actual risk, and ongoing compliance uplift.
Delivered through governance frameworks, board-ready risk reporting, security architecture uplift, and compliance uplift: the same programme structure behind a live data-breach simulation programme and board-level Cyber Risk Committee for a four-country children's services enterprise. Additional specialist work beyond the retainer scope quoted separately; 6-month minimum term.
Book a discovery call →Ready for ongoing governance?
Book a 30-minute discovery call. No pitch, no obligation: a direct conversation about the standing cyber risk conversation your board isn't having yet.
Book a discovery call →