A cyber security strategy approved by the Board.
Digital transformation supported by security assurance.
Reduction in simulated phishing click rates.
The client’s perspective
Confidence at Board level.
Action across the business.
West Brom Building Society needed security to support its business plans and a major digital transformation.
Logica’s work connected the strategy with the teams, controls and decisions needed to deliver it. Hear Damon Morris, Chief Information Security Officer, explain the difference.
Start with the business risk.
Understand what matters, where the gaps sit and what needs to change.
Make the plan deliverable.
Agree priorities, ownership and investment, then support the work across the business.
Hear it from their CISODamon’s story · 7:55
“Logica Security didn’t just hand us findings, they gave us a plan we could actually act on.”
West Bromwich Building Society
Explore the video10 chapters
Strategy and leadership
A three-year plan.
Approved by the Board.
Logica assessed the current security approach against the NIST framework, a recognised way to review cyber risk and security controls. That assessment gave the Society a clear view of its starting point and priorities.
- Created a three-year Information and Cyber Security Strategy with Board approval.
- Defined priorities, measures, ownership and budget.
- Reshaped the security operating model, with a specialist team and senior security leadership.
Security became part of business planning, with clearer reporting for the Board and a practical route for delivery.
Monitoring and response
Security that works
around the clock.
A strategy needs a working response behind it. Logica brought monitoring, testing and incident preparation together.
See suspicious activity sooner
Microsoft Sentinel brought security signals together, supported by an outsourced security operations centre monitoring around the clock.
Test the systems and the response
Regular penetration testing checked new systems and the live environment. Incident and crisis exercises tested how teams would respond under pressure.
Turn alerts into clear action
Monitoring and alert assessment gave the Society a more consistent way to identify concerns and direct its response.
Third-party risk
Know which suppliers
need your attention.
Logica developed a managed approach to supplier risk, working through an assessment backlog and focusing effort on the relationships that mattered most.
- Grouped suppliers by risk and importance to the business.
- Used BitSight security ratings to support ongoing monitoring of critical suppliers.
- Added standard security audit rights to new and renewing supplier contracts.
The programme closed major third-party risk audit findings and gave procurement and the Board a clearer view of supplier security.
Explore third-party risk support ↗Architecture and access
Stronger boundaries.
Better control of access.
Logica strengthened the controls around systems, devices and powerful user accounts.
Limit how an incident can spread
Network separation created internal boundaries designed to limit movement between systems if an account or device was compromised.
Improve protection across devices
Microsoft Defender XDR added protection and analysis across the digital estate, helping teams connect signs of suspicious activity.
Control privileged access
CyberArk strengthened control of administrator access through monitoring, recorded sessions and multi-factor authentication.
People and behaviour
Over 60% fewer clicks
in phishing tests.
Logica combined regular practice with clear guidance and training. Monthly phishing simulations gave staff a safe way to learn how to spot suspicious messages.
- A central security hub made policies and guidance easier to find.
- Training reflected different roles, including staff with higher levels of system access.
- HR-linked records gave the Society visibility of training completion.
Simulated phishing click rates fell by more than 60%, while reporting of suspicious emails increased.
This result relates to phishing simulations, not a measured reduction in real-world attacks.
Governance and security by design
Security built into
£100m of change.
Logica embedded security architects into the Society’s digital transformation programme, bringing security into decisions from the design stage.
Build security into project decisions
Design templates, review checkpoints and pre-launch testing helped teams address security throughout delivery.
Give risks and audit actions clear owners
A revised risk and controls framework linked risks to named senior owners. A governance committee oversaw security performance and audit work.
Make policies and evidence easier to use
Simpler policies and mapped controls connected day-to-day security work with the information needed by leadership, audit and compliance teams.
The result was a clearer link between business change, practical controls and Board oversight.
Your next step
What would greater
security confidence mean for you?
Whether the pressure comes from the Board, a major project or your supplier network, start with a conversation about the outcomes you need.
An initial conversation, with no obligation to commission further work.