Interim or fractional senior leadership for security and privacy. Board-level reporting, programme oversight, incident command, and supervisory authority liaison on an annual or quarterly retainer.
Design, revision and operationalisation of security governance for medium-to-large enterprises. Policy architecture that is lived, not shelved—aligned to business risk appetite and auditor expectations.
Pragmatic risk and incident management that balances rigour with operational reality. Frameworks your teams will actually use, and training that changes behaviour rather than checking a box.
Governance overlay for engineering organisations building or procuring software at scale. From policy to pipeline, ensuring security is an enabler of velocity, not a blocker.
End-to-end design and stand-up of governance programmes against NIST 800-171, CMMC, ISO 27001 and GDPR. Includes policy architecture, control mapping, RoPA, DPIA templates and internal audit enablement.
Focused diagnostics ahead of certification, customer assurance reviews or regulatory inspection. Practical, prioritised remediation plans, not pages of generic findings.
Buy-side and sell-side security, privacy and compliance diligence. Materiality-focused findings that hold up under counsel review and integration planning.
Engagements typically begin with a confidential conversation.
Open a Discussion →