Need senior cyber security advice, without hiring a full-time security chief?

Maybe you’ve been asked for Cyber Essentials and don’t know where to start. Maybe you’re a growing business or charity whose board wants to know who’s responsible for cyber risk, and the honest answer is “nobody, really”.

Either way, you need senior, plain-English cyber security advice from someone who’s done it before. We offer that in two ways: as an NCSC Cyber Advisor, to get smaller organisations through Cyber Essentials, and as a fractional CISO, who leads your security on an ongoing basis without the cost of a full-time hire.

NCSC Cyber Advisor: getting Cyber Essentials sorted

Cyber Advisor is a scheme created by the National Cyber Security Centre (NCSC) to help small and medium-sized organisations with little or no in-house cyber security skill get Cyber Essentials in place. Cool Waters Cyber is an NCSC Assured Service Provider delivering Cyber Advisor services across Cornwall and the rest of the UK.

Working with us as your Cyber Advisor, you get:

• Friendly, non-judgemental, practical advice
• A clear action plan to improve your cyber security
• All the policies and procedures you need for Cyber Essentials, written around the way you work so they cause as little disruption as possible
• A pass at Cyber Essentials, guaranteed if you follow our advice
• Ongoing advice for a whole year to keep you on track
• Help putting it all in place: we can work with your in-house IT team or IT company, or manage them for you

Fractional CISO: ongoing security leadership

A Chief Information Security Officer (CISO) is the senior person responsible for an organisation’s security. Most small and medium-sized businesses and charities need that leadership but can’t justify a full-time salary for it. Our fractional (sometimes called virtual) CISO service gives you an experienced security leader, and you pay only for what you need, when you need it.

Your CISO works with your leadership team and gives pragmatic advice that fits your budget and culture. They take care of:

• Security strategy. A cyber security plan aligned with your business goals.
• Policies. All the policies and procedures you need to run securely and meet the regulations and standards that apply to you.
• Risk assessment and management. Finding and ranking your risks, and planning how to reduce them.
• Incident response planning. A clear plan for when something goes wrong, so you limit the damage and the downtime.
• Security awareness training. Helping your staff avoid the everyday mistakes attackers rely on.
• Compliance. Meeting UK GDPR and PCI DSS, and working towards standards such as Cyber Essentials, IASME Cyber Assurance and ISO 27001.
• Technology advice. Commercially sensible recommendations on which security products are worth your money, and which aren’t.

Which one do I need?

• Cyber Advisor if you’re a smaller organisation and your immediate goal is Cyber Essentials.
• Fractional CISO if you need someone to own your security strategy, answer to your board, and steer you through standards like ISO 27001 over time.

If you need hands-on people doing the security work every day, not just leading it, look at our Managed Cyber Team.

What we don’t do

• We don’t certify you against ISO 27001. We prepare and implement it with you; a UKAS-accredited certification body carries out the certification audit.
• We don’t do the day-to-day security work under this service. That’s what our Managed Cyber Team is for.

Talk to us

Tell us what you’ve been asked for, or what your board is asking, and we’ll suggest the right starting point.

Talk to us