Cybersecurity strategy that survives the budget meeting.

Benchmarking against industry standards, done properly. We assess each domain of NIST CSF and each relevant control area of ISO 27001:2022 on evidence rather than on self-report, because the gap between what a policy says and what happens on a Tuesday is exactly what the assessment is for.

The output is a maturity position per domain with the evidence behind each rating, a comparison against what is normal for organisations of your size and sector, and a clear statement of which gaps actually matter given your risk profile. A low rating in a domain that carries no material risk for you is noted and deliberately not prioritised.

Run once, it tells you where you stand. Run annually, it tells you whether the programme is working, which is a far more useful conversation to have with a board than an absolute score.

A roadmap says what will be done. An operating model says who does it, with what, reporting to whom, and how it is funded, and it is the part that determines whether the roadmap survives contact with reality.

We design the security function around what the organisation actually needs: which capabilities are built in-house, which are outsourced and which are automated; how security engages with engineering, IT, legal and procurement; where accountability sits for risk acceptance; and what the function costs to run at the target state rather than only to reach it.

For most mid-sized organisations the honest answer is a small internal team owning risk, governance and architecture, with monitoring, testing and specialist work delivered externally. Designing that split deliberately is considerably cheaper than arriving at it by accident over five years.

Boards are accountable for cyber risk and are frequently briefed in a language that makes the accountability impossible to exercise. Vulnerability counts, patch percentages and maturity scores do not answer the questions directors are obliged to ask: is this risk within our appetite, is the investment proportionate, and would we cope?

We build reporting that translates. Risk expressed in business impact terms, a small set of measures that show direction rather than decoration, the investment case with what each tranche buys and what declining it accepts, and a clear picture of the organisation's readiness to respond.

Where useful, we present directly (at a board meeting, an audit committee or an investor review) and we run director briefings so that non-executives can interrogate the material properly. Rehearsing an incident with the board before one happens is consistently the most valuable session in the programme.

Culture is what people do when the policy is inconvenient. It is set far more by what leadership visibly does, by whether reporting a mistake is safe, and by whether the secure route is the easy route, than by an annual training module.

We assess the current culture through behavioural indicators rather than a survey: reporting rates versus incident rates, how long people wait before escalating, the workarounds in daily use and what they say about controls that do not fit the work, and then address the specific behaviours that carry the most risk.

Delivery pairs with the practical programmes: security awareness training for capability and phishing simulation for measurement. The governance contribution is making it a leadership objective with an owner and a metric, rather than a compliance task that HR administers each January.