Get clear answers.
Choose your next step.

Our primary focus is financial services, including the security, risk and leadership teams responsible for protecting customers and keeping services running. We also support other regulated industries. We start with the services you provide, the risks you face and the requirements that apply to your organisation.

Certification provides useful assurance within its scope. It does not guarantee that every weakness has been found or that your response will work under pressure. Check how your safeguards operate day to day, test realistic incidents and keep evidence current. Use the results to prioritise improvements.

Third-party risk management, often shortened to TPRM, means understanding and managing the risks from companies you rely on. A supplier might store customer data, run a payment system or support your staff. You need to know what could happen if it fails, what protection is in place and who will act.

Match the checks to the harm a failure could cause. Review the service, data access, security evidence, contract terms and recovery plans. Higher-risk suppliers need closer attention. If a provider handles personal data on your behalf, UK GDPR requires checks for sufficient guarantees and the required written contract terms.

It means being able to prevent, handle and recover from disruption while limiting harm. For a financial firm, the question might be whether customers can still make payments or reach their accounts when a system fails. Map the people, technology and suppliers behind key services, then test how you would respond.

No. The Digital Operational Resilience Act is an EU law for financial entities within its scope. UK businesses may be affected through EU operations or supplier contracts. Separate UK requirements can also apply. Start by checking your legal entity, services and relationships, rather than assuming one set of rules fits every business.

AI governance means setting clear rules and responsibilities for how your organisation uses artificial intelligence. Know which tools people use, what information they share and who checks important outputs. Consider privacy, security and customer harm. Existing duties still matter when a decision or service uses AI.

No. Suppliers, services and threats change. Review the risks regularly and after important changes, such as a serious incident or new access to data. Keep track of open issues and verify fixes. Include important dependencies further down the supplier chain where they could affect your service.

Explain the possible impact and agree a practical response. Give each action an owner and deadline. Test or review the result so you know whether the fix worked. If a risk remains, make sure the right person understands and records the decision. Serious gaps may need action before the service can be used.

Tell us what prompted you to get in touch, which services are affected and any deadline you face. We will explore the problem and where we can help. Any proposed work should have a clear scope and intended outcome. An initial conversation does not commit you to a project.