Cyber and operational risk programs
The programs that made cyber governance defensible, built for boards that answer for it. This is where our practice started and the work continues.
What we do
Cyber risk management program
Oversight and management layersA defined, documented program that puts cyber risk where regulators, courts, and disclosure rules now expect it: owned at the top, measured against a tolerance the board set, and reported on a cadence that does not depend on an incident. Built on the approach set out in Building a Cyber Risk Management Program (O'Reilly Media, 2023).
Enterprise security risk management
Management layerSecurity run as a risk discipline rather than a set of tasks. Physical, cyber, and continuity risk managed in one life cycle, with business owners deciding what risk to accept and security showing them what it costs. Based on Enterprise Security Risk Management: Concepts and Applications (Rothstein Publishing, 2017).
Operational resilience
Oversight and management layersThe services that matter most, the tolerances for their disruption, the dependencies that can break them, and the evidence that you have tested the plan. Scoped for institutions that answer to a supervisor for it.
Board reporting on cyber and technology risk
Oversight layerWhat the board receives, how often, and what it does with it. We design the reporting line so directors can show they oversaw the risk and so management's disclosures rest on a program rather than a narrative.
Where it came from
Brian Allen ran security and enterprise risk at Time Warner Cable, a Fortune 100 company, and later worked with the largest U.S. banks on technology risk at the Bank Policy Institute. He was appointed by the Chairman of the Federal Communications Commission to work with NIST on the development of the Cybersecurity Framework and has served in the Communications Information Sharing and Analysis Center and the Communications Sector Coordinating Council.
The lesson from cyber is the one AI is repeating. The control frameworks matured first, the oversight layer went unbuilt, and it took a decade for regulators and courts to close the gap. We built our cyber practice closing it. We built our AI practice so clients do not wait a decade.
If your cyber program is a set of controls and a slide, start here.
A first conversation is 30 minutes with a senior member of our team. We listen to where you are and tell you plainly what we would look at first.