The risk assessment
The European Technology Risk Assessment, worked through for one organisation, with a document you own.
You already have, or can download, the framework. What you do not have is it applied to your systems, your data and your suppliers, with the findings written down and walked through. That is the £1,500 job.
What happens
We go through the framework one domain at a time, and I ask the questions the framework asks: what you run, where the data sits, who can reach it, what happens when a supplier goes down, and what you would do if the answer you rely on turned out to be wrong. You answer, or you point me at the person who can. It is a structured conversation, not an interrogation, and most of it is things you already know once somebody asks them in order.
We do it on a call, or on site in the North East. At the end you get the findings written down, ranked, and a walkthrough so the document is useful rather than filed.
What you get
- The framework worked through for your organisation, domain by domain, on your systems, your data and your suppliers.
- A written assessment with the findings ranked, so the first things come first and the rest follow in order.
- A walkthrough session, so you are not handed a document and left with it.
- A document you own, in a form you can share with a board, an insurer or a customer who asked.
- A note of what was out of scope, so nothing is implied that we did not cover.
Who this is for
An organisation with one specific technology risk question it needs answered and written down. Often that is a board, an insurer, a customer's due diligence, or a tender that asked for it. Owner-run firms of five to fifty people in the North East, and a small number of larger organisations.
Who this is not for
- Anyone after a penetration test or a technical security audit. This is a risk assessment, and it is not a test of your defences.
- Firms that want a certification. This does not certify you against any standard.
- Anyone who wants me to run the build. This is assessment and advice, and then you own the next step.
- Firms that want a two-hundred page report. You get a document you can act on.
Price
£1,500 fixed fee, payable on delivery. No subscription and no retainer. Remote, or on-site in the North East.
Ask about a risk assessment
Tell me the question you need answered, and I will tell you whether this is the right way to answer it.
Common questions
Is this the same as the ebook? The ebook is the framework, free to download, and it stays free. This is that framework applied to your organisation, with the findings written down and walked through.
Do you need access to our systems? Only what you choose to share. Most of this is a structured conversation, and I do not take copies of your data away.
How long does it take? It depends on how many domains are in scope and how quickly the people who hold the answers are available. We agree the scope and the dates before we start, so there is no moving target.
How is this different from the free guide? The guide is seven checks for continuity, the morning the till stops. This is the wider technology risk framework, and it is the version written down for you.
Is this anything to do with insurance? The framework covers the things an insurer asks about when a firm claims. But I do not sell insurance and I am not a broker. The assessment is about knowing where you stand before anyone needs to ask.
If the question is continuity rather than the wider picture, the resilience session is the smaller first step. The framework behind this assessment is the European Technology Risk Assessment, free to download.