Understand the cyber risk. Make the right business decision.
Independent cyber due diligence and business assurance for acquisitions, investment, business sales and supplier decisions. Clear evidence, material risks and practical next steps.
Security evidence. Business consequences.
A certification, policy or completed questionnaire is a starting point. The useful question is what the evidence tells you about the risk you are taking on.
I help owners, boards, investors and advisers review security governance, resilience and dependencies before an important commercial decision. The scope is agreed around your decision, access to evidence and timeframe.
Assurance for the decisions that matter.
Buyer-side cyber due diligence
Review governance, incident history, critical suppliers and recovery arrangements. Identify material risks, evidence gaps and priorities for further investigation or post-acquisition improvement.
Prepare for buyer scrutiny
Organise security evidence, identify gaps and prepare clear responses to diligence questions before a business sale or investment process.
Supplier and partner assurance
Assess policies, questionnaires, ISO certificates and SOC reports against your needs. Clarify dependencies, unresolved findings and decisions requiring risk acceptance.
Customer security assurance
Support security questionnaires and assurance calls with accurate, evidence-backed responses. Build a reusable evidence pack for future customer requirements.
Independent risk review
Give executives a concise view of security maturity, ownership, resilience and improvement priorities, with findings expressed in business terms.
From findings to action
Turn the assessment into an accountable improvement plan. Add fractional CISO support where continuing leadership is needed.
Clear findings. Practical next steps.
- Agreed scope, evidence requests and management interviews
- Review of documents, control evidence and relevant assurance reports
- A concise report on material risks, gaps and evidence limitations
- Prioritised recommendations, owners and follow-up questions
- A discussion of the implications for your business decision
A clear view of what is known, what remains uncertain and what needs to happen next.
A focused scope. Proportionate assurance.
Does every review need technical testing?
No. Interviews and evidence review can establish governance, assurance and resilience gaps. Where a decision needs penetration testing, forensic investigation or specialist architecture analysis, I help define that additional scope and coordinate the relevant specialists.
Can you work with our existing advisers?
Yes. I can work alongside corporate finance advisers, legal teams, fractional CFOs, IT providers and internal teams, with clear responsibilities and reporting.
Can you help before we sell or raise investment?
Yes. Readiness work can organise your evidence and address gaps before buyer or investor questions arrive. Findings reflect the scope and evidence available; they do not guarantee an incident-free business or a transaction outcome.
Is ongoing support available?
Start with a defined project, then add fractional CISO leadership to oversee improvements where needed.
Bring clarity to your next business decision.
Tell me about the transaction, supplier or customer requirement you need to support.