What should a board receive in a cyber assurance report?

Decision-ready information: critical services and dependencies, material risks and their owners, position against agreed risk appetite, evidence of control effectiveness, resilience readiness, open findings and residual risk that has been formally accepted.

Which cyber frameworks can IG-Smart assess against?

Depending on scope and sector, reference points may include the Cyber Governance Code of Practice, NCSC guidance, the NCSC Cyber Assessment Framework, ISO/IEC 27001:2022, Cyber Essentials, NIS requirements for in-scope organisations, NHS requirements and customer assurance requirements. Not every framework applies to every organisation.

Can IG-Smart work alongside an existing CISO or internal security team?

Yes. IG-Smart works alongside CISOs, security teams and technical suppliers, adding governance structure, independent challenge and assurance. It does not replace operational security functions unless specifically contracted to perform an appropriate role.

Can the engagement support procurement or customer assurance?

Yes. Outputs can include structured evidence prepared for customer due diligence, procurement questionnaires, tenders, audit or regulatory scrutiny, where that is part of the agreed scope.

Cyber Governance & Assurance

Cyber Governance & Assurance for Boards and Regulated Buyers

Give leadership a clearer, more defensible view of cyber risk, resilience, suppliers and technical assurance.

Turn complex governance, risk and control information into evidence your Board can understand, challenge and act on.

Discuss Cyber Governance Submit a Cyber Requirement

Not sure this is the right service? Find the Right Service

View relevant evidence

Find your starting point

Which problem are you solving?

Board visibility is weak. Technical reports exist, but leaders cannot clearly see material risk, ownership or residual exposure.

ISO 27001 is approaching. Governance, ISMS evidence or control ownership needs to be assessed and strengthened — see ISO 27001 Readiness below.

Supplier risk is increasing. Critical third-party dependencies exist without proportionate ongoing assurance — see Managed Supplier Assurance below.

A system or control needs independent technical proof. See Penetration Testing below.

Service family

Explore cyber resilience & supplier assurance services

Grouped by how you need to engage. Each service has its own page with scope, outputs, evidence and investment.

A defined-scope assessment of cyber governance, control effectiveness or ISO/IEC 27001 readiness.: ISO 27001 ReadinessPrepare governance, risk management, ISMS arrangements, controls and evidence for an independent ISO/IEC 27001 certification process.
Authorised, controlled testing of networks, applications and wireless environments.: Penetration TestingAuthorised, controlled testing of networks, web and mobile applications and wireless environments, with executive reporting and retesting where agreed.
Continuing oversight of critical suppliers and third-party cyber risk.: Managed Supplier AssuranceBuild proportionate, ongoing evidence that key suppliers and technology partners are appropriately governed, resilient and understood.

When organisations engage us

Signals that it is time to act

Board visibility is weak
Technical reports exist, but leaders cannot clearly see material risk, ownership or residual exposure.
Procurement is demanding evidence
Customers or buyers expect credible cyber governance, resilience or certification-readiness evidence.
ISO 27001 is approaching
Governance, ISMS evidence or control ownership needs to be assessed and strengthened.
Supplier risk is increasing
Critical third-party dependencies exist without proportionate ongoing assurance.
An incident exposed governance gaps
Escalation, decision-making, communications or recovery arrangements need strengthening.
Audit or regulatory scrutiny is increasing
The organisation needs defensible evidence of how cyber risk is governed and assured.
The cyber function needs independent challenge
Management wants assurance beyond self-assessment.

Distinctions

Governance, resilience and technical testing answer different questions

Cyber Governance: Are cyber risks owned, directed and overseen effectively? Focus: accountability · strategy · risk appetite · reporting · oversight.
Cyber Resilience: Can the organisation withstand, respond to and recover from disruption? Focus: critical services · incident readiness · recovery · dependencies · exercises.
Technical Testing: Do specific systems or controls contain identifiable technical weaknesses? Focus: vulnerabilities · attack paths · configuration · technical control effectiveness.

Relevant evidence

Selected cyber governance and assurance engagements

Published engagements covering security maturity and readiness, supplier assurance and routine technical testing.

Anonymised engagement · Technology / SaaS / RegTech
A FTSE 100 organisation
Three-stage governance and audit-readiness plan
Audit-ready UK policies ahead of a third-party maturity assessment
View the evidence: A FTSE 100 organisation
Anonymised engagement · Media / Entertainment
A consortium of leading global news media organisations
Security training, risk assessment, protocols and round-the-clock advisory support
Journalist security in a hostile environment
View the evidence: A consortium of leading global news media organisations
Named client · Financial Services
AIG
Supplier data-governance audit
Nationwide supplier audit
View the evidence: AIG
Named client · Retail / Consumer
The Co-operative Group
Routine penetration testing
Preferred supplier relationship · 2+ years
View the evidence: The Co-operative Group

Explore all case studies →Request Cyber Assurance Evidence →

**Dan West**Global CIO, AIMIA ILSIntegrated privacy and information-security expertise

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

Subject-matter expert
Michael Abtar
LLB (Hons), PG.Dip.Law, Cert. DPO
View profile
Subject-matter expert
Dr Bright Mawudor
PhD
View profile
Client & programme contact
Julia Andrade
BA
Coordinates scope, practitioners, delivery and stakeholder communication.
View profile

Buyer decisions

Questions before you engage

What is cyber governance?

Cyber governance is the system of accountability, decision-making, risk ownership and oversight through which an organisation directs and assures cyber security, so leaders can understand whether material cyber risks are being managed effectively.

What is the difference between cyber governance and cyber security?

Cyber security operations protect, monitor and respond. Cyber governance decides who owns cyber risk, what level of risk is acceptable, how it is overseen and what evidence the board receives. Each depends on the other.

What is a cyber resilience assessment?

An assessment of whether the organisation can withstand, respond to and recover from serious cyber disruption to its critical services — covering dependencies, incident readiness and recovery, not only preventive controls.

How should organisations manage cyber risk from suppliers?

Proportionately and continuously: identify critical suppliers, understand their access and dependency, obtain appropriate evidence, set contractual controls and incident-notification terms, and review assurance over the life of the relationship, including exit planning.

Can IG-Smart help with ISO 27001 readiness?

Yes. IG-Smart supports ISO/IEC 27001 gap analysis, implementation and readiness. Certification itself is carried out by an independent certification body; IG-Smart does not certify.

Does IG-Smart provide penetration testing?

Technical testing can be included where it supports a wider assurance requirement. Depending on the agreed scope, it is delivered in-house or with appropriate specialist partners, and the delivery model is set out transparently in the proposal.

Ready to move forward?

Need a clearer, more defensible view of your cyber position?

Not sure which service applies? Find the Right Service

Still defining your requirement?
Discuss Cyber Governance
Discuss the requirement, risk, scope and the right engagement model with an experienced practitioner.
Discuss Cyber Governance
Have a defined scope, tender or RFP?
Submit a Cyber Requirement
Share a defined requirement, RFP, tender, statement of work or existing scope for senior review.
Submit a Cyber Requirement
Procurement or supplier assurance
Prepare for Procurement Review
Access company, security and assurance information for supplier review, with controlled evidence available on request.
Open Trust Centre

Cyber Governance & Assurance for Boards and Regulated Buyers

Which problem are you solving?

Explore cyber resilience & supplier assurance services

Signals that it is time to act

Board visibility is weak

Procurement is demanding evidence

ISO 27001 is approaching

Supplier risk is increasing

An incident exposed governance gaps

Audit or regulatory scrutiny is increasing

The cyber function needs independent challenge

Governance, resilience and technical testing answer different questions

Selected cyber governance and assurance engagements

A FTSE 100 organisation

A consortium of leading global news media organisations

AIG

The Co-operative Group

Specialist expertise, coordinated around your requirement

Michael Abtar

Dr Bright Mawudor

Julia Andrade