What to prepare for a security programme review
Prepare the scope, people and evidence for a security programme review that leads to useful business decisions.
Kurosec guidance
Security advice you can put to work.
Clear starting points, useful questions and practical templates for the work ahead. Written by Haroon Mahmood, drawing on security leadership experience, UK National Cyber Security Centre (NCSC) guidance and NIST resources.
Review and assurance
Improvement planning
Turning security findings into a practical improvement plan
Turn a report into owned work: prioritise exposure, agree realistic actions and check that the changes address the findings.
Policy and governance
Writing security policies people can actually use
Build a manageable set of security rules, responsibilities and procedures that people can use in their everyday work.
Supplier assurance
Reviewing supplier security without drowning in questionnaires
Focus supplier assurance on business dependency, information and access, then turn evidence into a clear decision.
Security leadership
The first 90 days of security leadership
A practical starting sequence for a new security lead: understand the business, choose priorities and establish useful oversight.
Awareness and human risk
Security awareness that changes the work
Use evidence and real working practices to design targeted security awareness, better processes and meaningful follow-up.
Practical tools
Use the guides in your own work.
Download a preparation brief or an action tracker, and adapt it to your business. No sign-up required.
Security review preparation brief
Work through the purpose, scope, people and evidence for your review. Fill it in with the person sponsoring the work.
Download Word document · editableSecurity improvement tracker
Record actions, owners, dates and the evidence needed to close a finding. Includes a blank tracker and separate illustrative examples.
Download Excel workbook · editable