Governance & Compliance
Cyber Essentials validates that a business has introduced proven cyber security and information assurance controls in line with recommended good practice.
Introduction
Why do we need GRC?
Governance, Risk and Compliance refers to a strategy for managing an organisation’s overall governance, enterprise risk management and compliance with regulations. Governance, Risk and Compliance is a structured approach to aligning IT with business objectives, while effectively managing risk and meeting compliance requirements.
A well-planned Governance, Risk and Compliance strategy comes with lots of benefits, including improved decision-making, more optimal IT investments, elimination of silos, and reduced fragmentation among divisions and departments. Many organisations consult a framework for guidance in developing and refining their Governance, Risk and Compliance functions rather than creating one from scratch; frameworks and standards provide building blocks that organisations can tailor to their environment.
Governance
The overall management approach through which senior executives direct and control the entire organisation, using a combination of management information and hierarchical management control structure.
Risk Management
The set of processes through which management identifies, analyses and, where necessary, responds appropriately to risks that might adversely affect realisation of the organisation’s business objectives.
Compliance
Achieved through management processes which identify applicable requirements, including assessing the risks and potential costs of non-compliance against the projected expenses.
WHAT DO WE COVER?
Our expertise
Cyber Essentials
Cyber Essentials certification demonstrates a base-level appreciation of cyber security within your organisation. The assessment process comprises of an online questionnaire being completed by the organisation, which captures information that supports the five controls being in place. If successful, the organisation will be awarded Cyber Essentials certification. Certification gives you peace of mind that your defences will protect against the majority of the most common cyber-attacks, as these attackers are looking for targets which do not have the Cyber Essentials technical controls in place.
IASME Governance
The IASME Governance standard, based on international best practice, is risk-based, and includes aspects such as physical security, staff awareness, and data backup. The IASME standard was recently recognised as the best cyber security standard for small companies by the UK Government when in consultation with trade associations and industry groups. The IASME governance self-assessment includes the Cyber Essentials assessment, as well as an assessment against the requirements of the GDPR. The audited IASME certification is seen as a realistic alternative to ISO27001 by an increasing number of companies.
ISO 27001
ISO 27001 is a specification for an information security management system built on a framework of policies and procedures that includes all legal, physical, and technical controls involved in an organisation’s information risk management processes. ISO 27001 uses a risk-based approach and is technology-neutral. The specification includes details for documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action. The standard requires cooperation among all sections of an organisation.