Insights
Sharper questions for the people who decide.
One perspective for each practice: security GRC, security strategy and enterprise security architecture blueprints. Each takes five minutes and ends with questions to take into your next leadership meeting.
Risk appetite is a decision, not a document
Why most appetite statements change nothing, and how to write one that does.
Read the article → Security strategyA security strategy should fit on one page
Five lines that tell a board where the money goes and why.
Read the article → Architecture blueprintsBlueprint before you build
What an enterprise security architecture blueprint contains, and what it saves.
Read the article →External reference points
Useful guidance. Applied to your context.
Public guidance that boards and executives can use to test their own oversight of cyber risk.
Cyber Governance Code of Practice
A UK reference for directors and boards taking ownership of cyber risk, strategy and oversight.
Read the code → (opens in a new tab) NCSCCyber Security Board Toolkit
Questions and resources to help boards engage with security leadership and understand their responsibilities.
Explore the toolkit → (opens in a new tab) UK government researchCyber Security Breaches Survey
Annual research on reported attacks, risk management and how organisations approach cyber resilience.
Read the survey → (opens in a new tab)External resources; listed for reference, not as endorsements or evidence of affiliation.