Engagement scoping / UK organisations
What should cyber resilience consulting cover?
Cyber resilience consulting for mid-sized organisations should connect business disruption, security controls and accountable decisions. These guides explain how to scope work around ISO 27001, the NIST Cybersecurity Framework, incident response planning, supply-chain risk and staff awareness.
Choose the work you need →Start with the business service. Define the evidence. Agree who owns the result.
01 / Management systemDo we need ISO 27001 certification or a better management system?
ISO 27001 work should start by separating the business need for certification from the need to manage information security. Explore information security management system boundaries, risk treatment, the Statement of Applicability and the evidence an audit can examine. Learn why consultancy, internal audit and certification are different purchases, and how a narrow certificate scope can leave a critical dependency outside the boundary.
Boundary decisionsAudit evidence
Scope ISO 27001 work →
02 / Risk outcomesHow does the NIST CSF become a funded action plan?
The NIST Cybersecurity Framework helps organise cybersecurity outcomes without prescribing a single control set. Compare Current and Target Profiles, understand the Govern function, and avoid treating Implementation Tiers as a universal maturity score. The guide shows how evidence, business consequences and named owners turn a framework discussion into an actionable backlog.
Profiles and gapsPrioritisation
Scope NIST CSF work →
03 / DisruptionWhat makes an incident response plan usable during an outage?
An incident response engagement should resolve authority, communications and recovery decisions before they become urgent. Examine out-of-band contacts, evidence handling, tabletop exercises and restoration dependencies. Understand how UK personal data breach reporting differs from technical escalation, including the ICO notification clock and the need for qualified legal input.
Decision rightsRecovery checks
Scope response planning →
04 / External dependenciesWhich suppliers need more than a questionnaire?
Supply-chain risk assessment should follow the service, access and data a supplier actually supports. Use NCSC supply-chain guidance to distinguish assurance documents from relevant evidence, examine subcontracting and concentration, and define incident cooperation and exit requirements. Certification can inform a decision; it cannot replace checking what the certificate covers.
Supplier criticalityContract and exit
Scope supply-chain work →
05 / Everyday decisionsHow can awareness work change behaviour without blaming staff?
Staff awareness works best when people can make a safe decision within their actual workflow. Scope role-specific learning for finance, service desks, administrators and managers. Compare completion records with reporting quality, examine the limits of phishing simulations, and connect the programme to accessible reporting routes and practical technical safeguards.
Role-specific practiceUseful evaluation
Scope awareness work →
What should be agreed before an engagement starts?
The scope should state the services in view, the decisions required and the evidence that will demonstrate completion. Add an accountable sponsor, access arrangements, exclusions, dependencies and a handover owner. A report is an output; a supported decision and maintained process are the reasons for commissioning it.
For a mid-sized organisation, the limiting factor may be the availability of the people who run payroll, maintain identity systems or approve supplier contracts. Ask prospective advisers how they will work around those constraints, protect sensitive evidence and distinguish advice from implementation. Keep certification fees, technical testing and incident retainers explicit rather than assuming they are included.
Ask a scoping question →