Cybersecurity and information security
We assess how information is protected across people, processes and systems, then set out policies, access controls and response plans in proportion to your risk.
Good security is proportionate. A ten person consultancy does not need the controls of a bank, and a bank cannot rely on the habits of a ten person consultancy. We start by understanding what you need to protect and who might want it, then recommend controls you can afford to run.
Where a service needs specialist certification, such as penetration testing, we say so and work with accredited partners.
Problems we solve
- Former staff still have access to email and shared drives.
- There is no written plan for what to do if systems are compromised or data is lost.
- Backups exist but have never been tested.
- Staff have not been trained to recognise phishing and social engineering.
- A bank, donor or client has sent a security questionnaire that nobody can answer.
What we provide
- Cybersecurity risk assessmentAvailable now
- Information security policies and proceduresAvailable now
- Network and endpoint security reviewAvailable now
- Incident response, business continuity and recovery planningAvailable now
- Staff security awareness trainingAvailable now
- Vendor and third party security reviewsAvailable now
- ISO 27001 implementation supportWith licensed partners
- Vulnerability assessment and penetration testingWith licensed partners
- Managed security monitoringIn development
Items marked "With licensed partners" need a licence or accreditation. We prepare the work and an NDPC licensed or accredited partner completes it. We always tell you who that partner is before you engage.
Who it is for
- Organisations with no written security policy
- Fintechs, microfinance banks and their suppliers
- NGOs answering donor security requirements
- Teams that have just had an incident and want to prevent the next one
Let's build a more secure and responsible digital environment.
Tell us what you need to protect. We will reply within two working days with next steps.
Request a cybersecurity assessment