Advisory

Cyber & technology risk

A useful risk program makes trade-offs visible and gives teams a practical way to act. We bring structure to complex technology environments without losing sight of how the business actually operates.

The mandate

See the risk clearly. Build the controls that matter.

From risk assessment and security strategy to control design and operating models, we connect technical decisions to business exposure.

Discuss this work

How we help

  • Enterprise and technology risk assessment
  • Security strategy and target operating model
  • Control design and policy architecture
  • Third-party and supply chain risk
  • Board and executive risk reporting

What the work produces

  • A risk register tied to business decisions
  • A prioritized, owned remediation roadmap
  • Controls that can be operated and evidenced

Delivery

From the first decision to a working program.

Each stage creates an artifact or operating practice the team can use.

01 / 04

Frame the exposure

Identify the services, data, dependencies, and business decisions that make cyber risk material. Agree a common risk scale before scoring individual findings.

Output: Business context, risk criteria, and assessment scope
02 / 04

Test the control reality

Interview owners and inspect how access, change, supplier, detection, response, and recovery controls actually operate. Record uncertainty where evidence is missing.

Output: Evidence-based risk and control assessment
03 / 04

Decide the treatment

Connect each priority risk to an accountable owner, a treatment decision, a target date, and the resources required. Escalate accepted risks to the right decision maker.

Output: Owned treatment roadmap and decision record
04 / 04

Report and revisit

Build a management view of material exposure, overdue actions, exceptions, and changes in the threat or business context. Refresh decisions as the environment changes.

Output: Executive risk reporting and review cadence

Common questions

Clarify the mandate before delivery.

What is the practical output of a cyber risk assessment?

A useful assessment identifies the most important exposures, the evidence behind them, the available treatment choices, and who will decide and act. A score alone does not provide a plan.

Can the same assessment support ISO/IEC 27001 or NIST CSF 2.0?

Yes, a well-scoped assessment can inform an ISMS risk treatment plan and a CSF Current and Target Profile. Each framework still has its own required structure and decisions.

How should third-party risk be included?

Start with the suppliers and outsourced services on which critical operations depend. Assess their access, data, service continuity, and contractual obligations in the context of the service they provide.

Primary references

Related frameworks

Apply it where it matters.

ISO/IEC 27001NIS2NIST CSF 2.0

Work with Normstone

Let’s build what stands up to scrutiny.

Tell us what you need to achieve. We’ll help define the right first step.

Start a conversation