Cyber security governance review
A structured review of how cyber risk is owned, managed and reported, from documented policies to day-to-day practice.
Suited to: Boards, directors and newly appointed security leads
Why it matters
Cyber risk is now a board-level matter. Directors are expected to understand the organisation’s exposure and to show that it is being managed. A governance review gives leadership a clear, independent picture of where responsibility sits, how decisions are made and whether the controls described in policy operate in practice.
When you might need it
- The board would like an independent view of cyber risk
- A new director or security lead needs a reliable baseline
- Insurers, investors or customers are asking more searching questions
- Policies exist, but nobody is certain that they are followed
What we review
- Security policies and how they are applied in practice
- Risk register and risk ownership
- Incident response and business continuity readiness
- Supplier and third-party oversight
- Reporting to leadership and the board
What you receive
- Maturity assessment across key areas
- Gaps against recognised good practice, including NCSC guidance
- Prioritised 90-day improvement plan
- Optional board briefing
Timescale and fees
Typically 3–6 working days, including interviews with the people who own and manage cyber risk. Each engagement is quoted at a fixed price for an agreed scope, and the timetable is confirmed in your proposal before any work begins.
Ways to engage
- Single review: One focused engagement with a fixed scope and price.
- Multi-area assurance: Several related areas reviewed together, with one consolidated report.
- Support for your audit team: Specialist IT audit capacity for an existing internal audit function.
- Annual assurance programme: A planned cycle of reviews that builds year-on-year evidence.
Independence
We never audit systems or services that we have designed, implemented or operated. Any existing relationship, including with our sister services, is declared in writing before work begins.
Questions
How does a governance review differ from a penetration test?
A governance review examines how cyber risk is managed: ownership, policies, decision-making and reporting. A penetration test examines whether a technical attack could succeed. They answer different questions and are often most valuable together.
Which framework do you use?
We draw on recognised good practice, including NCSC guidance and ISO/IEC 27001, and agree the reference framework with you during scoping.
Next step
The initial consultation is free and without obligation. We reply within one working day with a suggested scope.