Senior GRC advisory

Who it is for and when

Suits organisations that already have someone internally responsible for security or compliance but need reinforcement. The aim is not to take over the role, but to help your own organisation become more confident, clearer and more consistent.

• You have an internal security lead who needs an experienced sounding board.
• An audit, a risk assessment or a supplier review is coming up and you want support delivering it.
• The policies exist but are rarely updated, and nobody owns the whole.
• Management receives reporting that is hard to make decisions on.

What we do

1. Current state and format. We start by understanding the situation: does the role already exist internally, is the need temporary or long term, and do you need someone to drive the work or someone to support and quality-assure it.
2. Annual agenda. We set a recurring agenda for risk, policies, controls, suppliers and management reporting, so the work is not driven by whatever happens to become urgent.
3. Ongoing support on the substance. Risk assessments, audits, supplier reviews, policies and interpretation of requirements from ISO 27001, the GDPR and the Swedish Cybersecurity Act among others.
4. Quality assurance. We review what you have produced before it goes to management, a customer or an auditor.
5. Management reporting. We help turn the reporting into something management can decide on: prioritised risks, status of actions and what needs a decision.

Scope and price

An ongoing engagement, a number of days per month, with the scope set by how much your own function needs reinforcing. The arrangement can be adjusted as the engagement proceeds.

The price is driven by the scope and the length of the engagement. You get an estimated cost proposal and, where possible, a fixed price.

How it works

1. A first conversation. We listen to your situation and explain how we usually set up the work. You get our assessment straight away, free of charge.
2. A proposal with scope and price. A short written proposal with what is included, what you get, who does the work and what it costs.
3. Delivery and ongoing work. We work together with your organisation to the agreed agenda, quality-assure the documentation and report to management throughout the engagement.