Skip to main contentSkip to privacy choices

Cyber Governance & Assurance

Cyber Governance & Assurance for Boards and Regulated Buyers

Give leadership a clearer, more defensible view of cyber risk, resilience, suppliers and technical assurance.

Turn complex governance, risk and control information into evidence your Board can understand, challenge and act on.

View relevant evidence — View Relevant Evidence

Selected client experience

Relevant client engagements

View all case studies

Evidence at a glance

Find your starting point

Which problem are you solving?

Board visibility is weak.

Technical reports exist, but leaders cannot clearly see material risk, ownership or residual exposure.

Virtual CISO & Cyber Governance
ISO 27001 is approaching.

Governance, ISMS evidence or control ownership needs to be assessed and strengthened.

ISO 27001 Readiness
Supplier risk is increasing.

Critical third-party dependencies exist without proportionate ongoing assurance.

Managed Supplier Assurance
A system or control needs independent technical proof.

Authorised, controlled testing of networks, web and mobile applications and wireless environments, with executive reporting and retesting where agreed.

Penetration Testing

Service family

Explore cyber resilience & supplier assurance services

Grouped by how you need to engage. Each service has its own page with scope, outputs, evidence and investment.

A defined-scope assessment of cyber governance, control effectiveness or ISO/IEC 27001 readiness.

When organisations engage us

Signals that it is time to act

  • Board visibility is weak

    Technical reports exist, but leaders cannot clearly see material risk, ownership or residual exposure.

  • Procurement is demanding evidence

    Customers or buyers expect credible cyber governance, resilience or certification-readiness evidence.

  • ISO 27001 is approaching

    Governance, ISMS evidence or control ownership needs to be assessed and strengthened.

  • Supplier risk is increasing

    Critical third-party dependencies exist without proportionate ongoing assurance.

  • An incident exposed governance gaps

    Escalation, decision-making, communications or recovery arrangements need strengthening.

  • Audit or regulatory scrutiny is increasing

    The organisation needs defensible evidence of how cyber risk is governed and assured.

  • The cyber function needs independent challenge

    Management wants assurance beyond self-assessment.

Distinctions

Governance, resilience and technical testing answer different questions

Cyber Governance
Are cyber risks owned, directed and overseen effectively? Focus: accountability · strategy · risk appetite · reporting · oversight.
Cyber Resilience
Can the organisation withstand, respond to and recover from disruption? Focus: critical services · incident readiness · recovery · dependencies · exercises.
Technical Testing
Do specific systems or controls contain identifiable technical weaknesses? Focus: vulnerabilities · attack paths · configuration · technical control effectiveness.

Relevant evidence

Selected cyber governance and assurance engagements

Published engagements covering security maturity and readiness, supplier assurance and routine technical testing.

  • Anonymised engagement · Technology / SaaS / RegTech

    A FTSE 100 organisation

    Three-stage governance and audit-readiness plan

    Audit-ready UK policies ahead of a third-party maturity assessment

    View the evidence: A FTSE 100 organisation

  • Anonymised engagement · Media / Entertainment

    A consortium of leading global news media organisations

    Security training, risk assessment, protocols and round-the-clock advisory support

    Journalist security in a hostile environment

    View the evidence: A consortium of leading global news media organisations

  • Named client · Financial Services

    AIG

    Supplier data-governance audit

    Supplier audit · ISO 27001 internal-audit assurance for records management and physical security within supplier audit scope

    View the evidence: AIG

  • Named client · Retail / Consumer

    The Co-operative Group

    Routine penetration testing

    Preferred supplier relationship · 2+ years

    View the evidence: The Co-operative Group

Explore all case studies →Request Cyber Assurance Evidence →

Client perspective

“IG Smart have provided us with quality subject matter experts surrounding GDPR and Privacy risk-based analysis and remediation; supplying qualified senior information security and experienced DPO and specialists.”

Dan WestGlobal CIO, AIMIA ILSIntegrated privacy and information-security expertise
View AIMIA evidence — AIMIA ILS case study

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

  • Subject-matter expert

    Michael Abtar

    LLB (Hons), PG.Dip.Law, Cert. DPO

    View profile

  • Subject-matter expert

    Dr Bright Mawudor

    PhD

    View profile

  • Client & programme contact

    Julia Andrade

    BA

    Coordinates scope, practitioners, delivery and stakeholder communication.

    View profile

Buyer decisions

Questions before you engage

What is cyber governance?

Cyber governance is the system of accountability, decision-making, risk ownership and oversight through which an organisation directs and assures cyber security, so leaders can understand whether material cyber risks are being managed effectively.

What is the difference between cyber governance and cyber security?

Cyber security operations protect, monitor and respond. Cyber governance decides who owns cyber risk, what level of risk is acceptable, how it is overseen and what evidence the board receives. Each depends on the other.

What should a board receive in a cyber assurance report?

Decision-ready information: critical services and dependencies, material risks and their owners, position against agreed risk appetite, evidence of control effectiveness, resilience readiness, open findings and residual risk that has been formally accepted.

What is a cyber resilience assessment?

An assessment of whether the organisation can withstand, respond to and recover from serious cyber disruption to its critical services — covering dependencies, incident readiness and recovery, not only preventive controls.

How should organisations manage cyber risk from suppliers?

Proportionately and continuously: identify critical suppliers, understand their access and dependency, obtain appropriate evidence, set contractual controls and incident-notification terms, and review assurance over the life of the relationship, including exit planning.

Can IG-Smart help with ISO 27001 readiness?

Yes. IG-Smart supports ISO/IEC 27001 gap analysis, implementation and readiness. Certification itself is carried out by an independent certification body; IG-Smart does not certify.

Does IG-Smart provide penetration testing?

Technical testing can be included where it supports a wider assurance requirement. Depending on the agreed scope, it is delivered in-house or with appropriate specialist partners, and the delivery model is set out transparently in the proposal.

Which cyber frameworks can IG-Smart assess against?

Depending on scope and sector, reference points may include the Cyber Governance Code of Practice, NCSC guidance, the NCSC Cyber Assessment Framework, ISO/IEC 27001:2022, Cyber Essentials, NIS requirements for in-scope organisations, NHS requirements and customer assurance requirements. Not every framework applies to every organisation.

Can IG-Smart work alongside an existing CISO or internal security team?

Yes. IG-Smart works alongside CISOs, security teams and technical suppliers, adding governance structure, independent challenge and assurance. It does not replace operational security functions unless specifically contracted to perform an appropriate role.

Can the engagement support procurement or customer assurance?

Yes. Outputs can include structured evidence prepared for customer due diligence, procurement questionnaires, tenders, audit or regulatory scrutiny, where that is part of the agreed scope.

Related insight: What Does an Independent Cyber Security Audit Actually Cover?

For procurement and supplier onboarding

  • Registered on the Coupa Supplier Portal
  • Registered on the SAP Ariba Supplier Portal

Supplier-portal registration does not imply accreditation, endorsement, preferred-supplier status or approval by every organisation using the platform.

Ready to move forward?

Need a clearer, more defensible view of your cyber position?

Not sure which service applies? Find the Right Service

  • Still defining your requirement?

    Discuss Cyber Governance

    Discuss the requirement, risk, scope and the right engagement model with an experienced practitioner.

    Discuss Cyber Governance

  • Have a defined scope, tender or RFP?

    Submit a Cyber Requirement

    Share a defined requirement, RFP, tender, statement of work or existing scope for senior review.

    Submit a Cyber Requirement

  • Procurement or supplier assurance

    Prepare for Procurement Review

    Access company, security and assurance information for supplier review, with controlled evidence available on request.

    Open Trust Centre