Cybersecurity and information security
We assess how information is protected across people, processes and systems, then set out policies, access controls and response plans in proportion to your risk.
Good security is proportionate. A ten person consultancy does not need the controls of a bank, and a bank cannot rely on the habits of a ten person consultancy. We start by understanding what you need to protect and who might want it, then recommend controls you can afford to run.
Where a service needs specialist certification, such as penetration testing, we say so and work with accredited partners.
Problems we solve
- Former staff still have access to email and shared drives.
- There is no written plan for what to do if systems are compromised or data is lost.
- Backups exist but have never been tested.
- Staff have not been trained to recognise phishing and social engineering.
- A bank, donor or client has sent a security questionnaire that nobody can answer.
What we provide
- Cybersecurity risk assessmentAvailable now
- Information security policies and proceduresAvailable now
- Network and endpoint security reviewAvailable now
- Incident response, business continuity and recovery planningAvailable now
- Staff security awareness trainingAvailable now
- Vendor and third party security reviewsAvailable now
- ISO 27001 implementation supportWith licensed partners
- Vulnerability assessment and penetration testingWith licensed partners
- Managed security monitoringIn development
Items marked "With licensed partners" need a licence or accreditation. We prepare the work and an NDPC licensed or accredited partner completes it. We always tell you who that partner is before you engage.
Questions people ask
We are a small organisation. Do we really need cybersecurity help?
Most attacks on small organisations are simple, such as phishing, reused passwords and unpatched devices. A few basic controls and staff training prevent most of them, and that is where we start.
Do you carry out penetration testing?
Penetration tests need certified testers and specialist tools. We scope the test, work with accredited partners who carry it out, and help you fix what they find.
What should we do if we think we have been hacked?
Contain it, preserve evidence and get help quickly. Use our Had a breach? page to calculate your 72-hour NDPC notification deadline and contact us immediately.
Can you help us answer a security questionnaire from a bank or donor?
Yes. We help you answer accurately, identify gaps the questionnaire reveals, and put the missing controls in place.
Do you offer security awareness training?
Yes. Practical sessions on phishing, passwords, multi factor authentication and safe use of devices and messaging apps, using examples from your sector.
Who it is for
- Organisations with no written security policy
- Fintechs, microfinance banks and their suppliers
- NGOs answering donor security requirements
- Teams that have just had an incident and want to prevent the next one
Let's build a more secure and responsible digital environment.
Tell us what you need to protect. We will reply within two working days with next steps.
Request a cybersecurity assessment