Governance

The drive for business value continues to drive the deployment of technology as a critical tool in many forward looking and innovative organisations. This makes it ever imperative for businesses to align their information security with the business objectives to ensure that it supports their intention. Intrinsic to this is the explicit and demonstrated support of management by ensuring the right structures are in place to support these objectives.

We work with organisations to design strategies, policies, standards, procedures and guidelines that will ensure that risks are managed properly and the organisations’ resources are used responsibly and business objectives are met.

Risk

Risks are a permanent feature of a business in the modern world. The complexity and constantly changing nature of business makes it imperative for organisations to deal with uncertain events which could have an impact on achievement of business objectives.

Our consultants have good experience of not only identifying business and technology risks but also reporting on the severity of these risks and recommending mitigation strategies. These covers risk assessments, risk mitigation, risk treatment plan, tracking risks through a risk Register. We can guide internal staff on these activities on a one off basis or be engaged to carry this out on a periodic basis.

We work with organisations to

• Conduct risk assessments for business applications and infrastructure systems
• Carry out risk assessment within a defined functional or technical area of business or project identifying & recommending mitigation actions
• Implement consistent processes for identifying potential risk events and patterns
• Quantify and document the probability of occurrence and impact on the business
• Coordinate the development of countermeasures and contingency plans to limit the damage
• Provide advice and guidance on strategies to manage the identified risks and recommend appropriate control improvements.

Compliance

The reality facing the modern business is the necessity to comply with a host of regulations enacted by governments or standards laid out by industry bodies to ensure that organisations are run in the best interest of all stakeholders. Some of these regulations are;

• PCI DSS – Payment Card Industry Data Security Standard
• SOX – Sarbanes Oxley
• DPA – Data Protection Act

We work with organisations to identify, assess and manage risks related to compliance in their area of business by helping them to;

• Understand the objectives of regulations and standards
• Interpret the requirements of the regulations and standard
• Identify and analyse gaps in your current compliance position
• Select required controls (covering people process and technology) through risk assessment to achieve compliance
• Develop and implement standards, policies and procedures to achieve compliance
• Assess whether your information security management systems are fully operational and that controls have been implemented consistently as required