RISK · CONSULTING SERVICES
Put the budget where the risk actually is
Technical exposure turned into business language leadership can act on: assets and threats identified, likelihood and impact assessed, a living risk register with treatment plans, and scheduled re-assessment as the environment changes — so budget and attention go to the risks that matter, and the board gets reporting it can trust.
ENGAGEMENT AT A GLANCE
ScopeCorporate IT and OT/ICS
BasisISO 31000 · NIST RMF
OutputLiving risk register + treatment plans
YOU RECEIVE
Asset and threat inventory across IT and OT
Likelihood and impact assessment, quantitative and qualitative
Risk register with owners, treatment plans and residual risk
Board-level risk reporting in business terms
Re-assessment schedule tied to change in the environment
WHAT'S COVERED
Scope of the engagement
01
Asset & threat identification
What you own, what it is worth to the business, and what could credibly threaten it — across the corporate systems and the plant floor alike.
02
Likelihood & impact assessment
Each risk scored with quantitative methods where the data supports them and qualitative ones where it does not, so the register is honest about both.
03
Living risk register
A record that is maintained rather than a spreadsheet that is filed: owners, treatment decisions and residual risk, kept current as the estate changes.
04
Treatment plans
Mitigate, transfer, accept or avoid — decided by the people accountable, with the cost and the residual risk written next to each decision.
05
OT/ICS risk modelling
Industrial assets assessed for safety and availability impact rather than confidentiality alone — which is how a manufacturing or process environment actually fails.
06
Board reporting & re-assessment
Reporting leadership can trust, and a re-assessment cadence so the register still describes the environment a year on.
COMMON QUESTIONS
Before you ask
Is this a one-off assessment or an ongoing programme?
It is designed as ongoing. The first pass builds the register; re-assessment is then scheduled as the environment changes, because a register that describes last year’s estate is worse than none.
Does it cover our OT and industrial systems?
Yes. OT/ICS risk is modelled for manufacturing and industrial clients with safety and availability impact in view, alongside the corporate IT estate — one register, not two.
What will our regulator expect to see?
A register with owners, treatment decisions and residual risk, reviewed on a cadence. Ours are built for FRA- and CBE-regulated banks and insurers and aligned to ISO 31000 and NIST RMF; what your specific regulator expects is confirmed during scoping so the register takes that shape from the start.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Executive risk summary written for a board
Asset and threat inventory with business owners
Risk register with likelihood, impact and residual risk per entry
Treatment plans with owners, cost and dates
Re-assessment schedule and reporting template
WHAT WE NEED FROM YOU
An executive sponsor who owns risk acceptance
Asset inventories and architecture documentation, however incomplete
Access to the business and OT process owners
Your regulator’s reporting expectations, where they exist
FRAMEWORKS THIS EVIDENCES
ISO 31000NIST RMFISO/IEC 27005ISO/IEC 27001:2022
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.