@

Cybersecurity advisory services

My team and I help organisations build a security programme that fits the business: strategy, compliance, risk and resilience, and the technical testing that proves it works. Depending on the service, I deliver it myself or lead a team of specialists.

StrategyComplianceRisk & resilienceAwarenessTechnical assurance

Strategy & Governance

Direction, leadership and architecture
  • Cybersecurity strategyAlign security with your business goals and budget, with a roadmap that raises your security posture in a set time frame, clear policies and procedures, and guidance on data privacy.
  • Maturity assessmentAn independent view of your security programme across people, process and technology, so leaders invest in the right things.
  • Virtual CISOAn experienced security leader, part-time and remote: policies, risk, compliance and reporting to management, without the cost of a full-time CISO. Built for smaller organisations.
  • Security architecture frameworkA business-driven security architecture based on SABSA and mapped to NIST and ISO 27001:2022, from strategy and design to implementation and measurement.

Compliance Advisory

Local and international standards

We assess your controls and processes against local and international standards, with evidence, and give you a clear plan for the gaps.

  • NCA ECC-1:2018
  • NCA CCC-1:2020
  • NCA CSCC-1:2019
  • NCA TCC-1:2021
  • NCA OSMACC-1:2021
  • NCA NCS-1:2020
  • SAMA CSF
  • CST Cybersecurity Regulatory Framework
  • Aramco Third Party Cybersecurity Standard
  • NDMO
  • ISO 27001:2022
  • ISO 27017:2015
  • ISO 27018:2019
  • PCI DSS v4

Risk & Resilience

Know your risks, recover from disruption
  • Risk managementIdentify, analyse and evaluate the risks to your assets and operations (ISO 27005), with clear treatment recommendations and ongoing monitoring.
  • Business impact analysisFind your critical business functions, set recovery time and recovery point objectives (RTO, RPO), and plan how to recover from disruption.
  • Cybersecurity resilience reviewHow well can you manage cyber risk in normal times and in a crisis? A review of asset, vulnerability, incident, continuity and risk management, built for the NCA ECC and SAMA resilience requirements.
  • Third-party riskA clear report on how you manage the risk from suppliers and partners, compared with your peers.

Awareness & Workshops

For staff, technical teams and leaders
  • Awareness strategy & workshopsI measure where your people stand, define an awareness strategy, and run focused workshops and events for staff, technical teams and leaders.
  • Phishing simulationsRealistic phishing campaigns that show how your people react, and where training is needed most.
  • Learning platform selectionHelp choosing and deploying the right platform for your security training.
  • CISSP training for teamsPrepare your security team for the CISSP exam with my academy: video lessons, Hani AI as their study assistant, and practice exams.

Technical Assurance

Delivered by my team of specialists, with me leading the engagement from scope to final report
  • Vulnerability assessmentFind, classify and prioritise the weaknesses in your network and systems, with a clear plan to fix them.
  • Penetration testingBlack, grey or white-box tests of your applications and systems, following OWASP and OSSTMM, from planning to a report with recommendations.
  • OT penetration testingTesting industrial and operational technology safely, to find the paths an attacker could use.
  • Red team exerciseA realistic, stealthy attack that tests whether your security team can detect and respond, using the tactics of real attackers.
  • Configuration & architecture reviewA review of your designs and device configurations against international standards such as CIS.
  • Source code reviewManual and automated review of your code for security flaws, aligned with OWASP and WASC.