Practices / Cybersecurity and Digital Risk
03 · Protect
Protected before, ready during, trusted after.
Every institution will face a serious incident. The difference between a bad week and a lost decade is preparation: knowing what you hold, who can reach it, how fast you would know, and what the board will say on the first morning.
The problem we solve
A breach is a technical event for an hour and a governance event for a year. Boards that have rehearsed it recover; boards that have not are still explaining it long after the systems are restored.
What we do
Six capabilities, one standard.
Each capability can be engaged on its own. Most clients find the work goes further when two or three are combined under one partner.
Cyber strategy and governance
Risk appetite, accountability and reporting set at board level, in language directors can act on.
Readiness assessment
A frank review against recognised frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework, prioritised by consequence.
Data protection and privacy
Records of processing, impact assessments and controls that meet the data protection law that applies to you.
Incident response and rehearsal
Playbooks, decision rights and a live exercise in which the board, the technical team and the spokesperson work one realistic incident together.
Third-party and supply-chain risk
Contracts, assurance and monitoring for the suppliers who hold your data or run your systems.
Resilience and continuity
The services that must survive, how long they can be down, and the plan that keeps them running.
The rehearsal
The first morning, practised in advance.
Our incident exercise runs a realistic scenario in real time. Directors, technical leads and the spokesperson each face the decisions that will fall to them.
Detection
An alert that might be nothing. Who decides whether it is an incident, and how quickly does the chief executive hear?
Containment
Systems isolated, evidence preserved, and a choice between keeping services running and stopping the spread.
Notification
Regulators, customers and partners told what they must be told, within the time the law allows, in words agreed in advance.
Recovery and review
Services restored in the right order, and an honest account of what failed, published to those who need it.
Where the practice joins others
Rarely engaged alone.
The practice works most often with these two. One partner leads, so the joins between them are nobody's blind spot.
Technology and Data
We sit on the client's side of the table: deciding what to build or buy, contracting for it, overseeing delivery and staying through the first months of live operation, when most programmes quietly fail..
Explore 05 · ExplainCommunications and Public Affairs
Regulators, investors, staff, partners and the public each decide something about you.
Explore Related perspectiveBefore the breach: seven questions a board can ask this quarter
ReadCybersecurity and Digital Risk
Start with one conversation with a partner.
Tell us what is at stake. We reply personally, in confidence, usually within two working days.