Advisory

We develop or enhance your Cyber Resilience Framework, ensuring alignment with supervisory expectations (e.g. ISO, DORA, NIS2, DNB Good Practices). 

Our approach includes: 

• Defining critical business services and mapping end-to-end dependencies (processes, systems, people, and vendors)
• Clarifying impact tolerances - understanding what level of disruption your organisation can realistically absorb
• Establishing governance structures and escalation paths that are effective in practice, not just on paper

We focus on proportionality: frameworks that fit your organisation's size, complexity, and regulatory footprint. 

We review or design your Business Continuity Management (BCM) and Crisis Response Plans, integrating them into the larger resilience framework. 

Our deliverables include: 

• Streamlined continuity plans that prioritise practicality over paperwork
• Scenario-based crisis simulations and “table-top exercises” for management teams
• Clear communication playbooks for internal and external stakeholders

Our goal: to make crisis governance second nature - structured, rehearsed, and credible. 

Because technology is at the heart of resilience, we work closely with IT and security teams to assess and strengthen IT continuity and cyber recovery capabilities. 

We review: 

• Backup and recovery architectures
• Incident response playbooks
• Disaster recovery testing results
• Integration with ICT risk and information-security policies 

We ensure that resilience controls are not just documented but demonstrable - verifiable in real time when it matters most. 

Modern organisations depend on a web of external suppliers and platforms. 

• We perform dependency mapping and critical vendor assessments to identify concentration risks and single points of failure
• We also review contract clauses, exit plans, and SLA frameworks to ensure alignment with DORA and DNB expectations
• When necessary, we help design outsourcing governance dashboards - giving management a clear overview of critical suppliers, resilience maturity, and risk exposure 

Resilience without testing is theory.

We design plausible but challenging scenarios to test your ability to respond and recover within impact tolerances. 

Our methodology covers: 

• Table-top and live simulations for management and IT teams
• Joint testing with key vendors
• Review of post-incident lessons learned and continuous improvement tracking
• Testing doesn’t need to be heavy - but it does need to be honest