We need to know whether we are in scope.
WORK
Map entities, services, systems and dependencies.
OUTPUT
Scope and requirements matrix.
Regulatory cybersecurity
Translate requirements into owned controls and reviewable evidence.
Establish scope, assess the current state and coordinate governance, technical and supplier remediation around business risk.
01 /STARTING SITUATIONS
Start with the actual situation.
A deadline is approaching but controls are incomplete.
WORK
Assess governance and technical gaps against business risk.
OUTPUT
Prioritised remediation roadmap.
We need supplier and incident evidence.
WORK
Review third-party oversight, incident response and records.
OUTPUT
Control owners, evidence register and review findings.
02 /THE WORK
Defined work, reviewable outputs.
Applicability & scope
Connect requirements to affected services, entities, systems and dependencies.
- Scope definition
- Critical service mapping
- Responsibility model
Risk & controls
Assess gaps and prioritise practical governance and technical controls.
- Gap assessment
- Risk register
- Control mapping
Third parties & resilience
Bring supplier oversight, incident readiness and continuity into the same programme.
- TPRM
- Incident process
- BIA / BCP / DRP
Evidence & review
Organise ownership, status and evidence so management and assurance functions can review progress.
- Evidence matrix
- Internal review
- Leadership reporting
03 /REVIEWABLE OUTPUTS
Outputs tied to the agreed scope.
- 01Scope and requirements matrix
- 02Gap assessment and risk register
- 03Prioritised remediation roadmap
- 04Control and policy documentation
- 05Evidence register and review findings
NEXT STEP
Define the right first engagement.
The first discussion defines the objective, scope and expected outputs.
Discuss the work