Cybersecurity
When a control moves money, you have to be able to show it worked
For the operational-resilience or security lead at a UK financial firm who has to evidence controls to the FCA, the PRA, or an auditor. Payments clear, alerts fire, access is granted — each one a control a regulator can ask a firm to prove under operational-resilience rules. When an important business service fails or a control is questioned, the record has to show it existed, who owned it, and that it worked. You get that record for each control, so resilience can be demonstrated on demand rather than asserted after the fact. Fixed fee and timetable agreed before we start, after a twenty-minute call.
Built by practitioners who have done this work inside banks and regulated firms.
Control Assurance
ScanningImportant business services
Mapped & prioritised
Access & identity controls
Who can reach what
Third-party dependencies
Vendor concentration
Backup & recovery tested
Restored in tolerance
Incident response evidence
Logged, owned, traced
A control is only assured when its evidence is current. Missing evidence is reported as “cannot attest” — never as assured.
Where it goes wrong
The mapping is finished; the evidence underneath it is not
Most firms have already done the visible work: important business services identified, impact tolerances set, the dependencies drawn. What is usually missing sits a layer below — whether each control in that map can be shown to exist, to be owned by a named person, and to have been tested since the diagram was drawn.
The gap surfaces at the worst moment: a service goes down, or somebody asks for the evidence behind a tolerance, and the map is the only thing anyone can produce.
How it works
Show it exists, show who owns it, show it worked
A control is only defensible if it can be shown to exist, to be owned, and to have worked. Each one is documented, tested, and mapped to the regulation it implements.
01
Shown to have worked
Every cyber and operational-resilience control gets a traceable, reproducible record, open to inspection, so the question a regulator, an auditor, or a board asks — did this control work? — has a written answer.
02
The controls that carry the risk
We focus on the controls a firm has to evidence to the FCA, the PRA, or an auditor — the ones that move money and keep services running, not the whole of information security.
Where it focuses
Where security meets what a regulator will ask for
The focus is the intersection of security and regulatory accountability — the controls a firm must be able to prove under operational-resilience and financial-crime expectations, using the same approach we apply to fraud and AML rules.
Operational resilience
The controls that keep important business services running — each mapped to the obligation it implements and to the evidence that it works, inside the impact tolerances the firm has set.
Control assurance
A reproducible record of which security controls exist, who owns them, when they were last tested, and where the evidence is missing.
Third-party & change risk
Where critical controls depend on vendors or change over time, a structure for showing they remain adequate, owned, and accountable.
What we cannot be
We cannot build a control and be its independent assurance
The same principle that governs the model and reporting work governs this one. Independence is the control, and an assurance opinion given by the party that designed the control does not satisfy it. Designing a control and attesting to it are separate engagements, and they do not both come from us.
Where we have built something, we will say so plainly, and the independent review goes to somebody else. Where a firm already has the control, reviewing it is work we can take.
Starting
Find the weakest control in one conversation
A short conversation is usually enough to identify where the record behind a control is weakest and what needs to change first. It needs no system access. Every enquiry is treated in confidence.