Cybersecurity and
ICT Audits

Cyber Risk Assessment
We have a proven cyber risk assessment methodology to determine what’s important to your business and identify gaps in talent, practices, and technologies that contribute to elevated risk. The process includes:

• Initiation – Establish the core team and structure for the assessment and finalize.

• Discovery – Collect the data needed to understand business environment, regulatory and contractual constraints, data collected and processed, and technology environment.

• Assessment – Conduct a detailed review of policies, processes, and technologies included in the scope of the assessment.

• Analysis – Determine gaps in controls using business risk tolerance, regulatory and contractual constraints, and relevant industry certifications as a reference for level of controls required.

• Recommendation – Develop detailed recommendations to close gaps using leading practices and define the roadmap needed to guide execution. Conduct reviews with core team prior to presenting findings to leadership.

The outcome of your cybersecurity engagement is a holistic, clear, and actionable cybersecurity strategy and roadmap needed to close gaps and manage risk.

​

Cybersecurity Governance
Cyber risk management is a journey not a destination. Your ability to maintain alignment with business risk tolerance and technology vision and adapt to changing cyber threats is critical. Our Cybersecurity Governance service is intended to enable the culture needed to accomplish this goal. We collaborate with you to ensure the right talent is in place, effective decision-making structures are available, relevant metrics are available to inform decisions, and policies guide the application of cybersecurity controls.

​

Security Principles – Establishment of security principles needed to promote a culture of risk management
Metrics & Reporting – Implementation of metrics tracking and reporting to inform risk management decision-making
Committee/Workgroup Structure – Definition and implementation of security decision-making process
Security Organization – Definition of the security organization including roles and responsibilities
Security Policies – Development of security policies and processes (ISO 27002 aligned)

Our experience and intellectual property greatly decreases the time to implement cybersecurity governance and increases effectiveness of the process.

​