Security programme review
ISO 27001, NIST CSF and CIS Controls assessments, with clear, business-prioritised recommendations on what to fix first.
Relevant UK NCSC guidance helps turn findings into practical next steps.What we do
Make security work across the business.
Clear policies
Create practical policies and standards that reflect how the business operates.
Policy, standards and control mapping for audits, customer reviews and day-to-day delivery.
Build security programmes
Put the security capabilities your business needs in place as it grows.
Practical programmes for security awareness, third-party risk, supplier assurance and embedding security into everyday operations.
Fractional security leadership
Experienced security leadership, often called fractional CISO support, without the cost of a full-time hire.
Set priorities, manage risk, support leadership decisions and provide ongoing direction as your security programme develops.Who you will work with
Haroon Mahmood
25+ years in information security, with a career that includes senior roles at global technology companies.
Engagements
Flexible support, with a clear outcome.
Assessment
A fixed-scope review of your programme, policies or a specific capability, ending in findings and a practical roadmap.
Project
Put a specific security capability in place and leave with something your business can use.
A defined piece of work such as a policy framework, security awareness programme, third-party risk process or certification readiness assessment.Retainer
Fractional security leadership arrangement. A small, predictable monthly commitment on an ongoing basis that provides consistent strategic guidance to keep security priorities on track and provides a trusted point of contact.
How we work
Independent, practical and clear.
Practical
A plan suited to your team, budget and business, moving at the speed of your organisation.
Plain language
Reports and policies that leaders, engineers and auditors can all use.
Independent
No software resale and no commercial interest in your buying decisions.
Practical guidance
A useful place to start.
Practical advice for reviewing your programme, making policies work and setting security priorities.
What to prepare for a security programme review
Get the right people, scope and evidence together before the review begins.
Writing security policies people can actually use
Turn security requirements into clear rules that fit the way people work.
The first 90 days of security leadership
Understand the business, choose priorities and agree who will move the work forward.