Kurosec services
Security programme development
Put the security capabilities your business needs in place, with clear ownership and processes your team can maintain.
Who it helps
Turn a security priority into everyday practice.
For security and delivery leaders who know what needs to improve and need support to build a working capability.
- A review has identified gaps, but your team needs help turning recommendations into a working process.
- Growth has exposed inconsistent approaches to suppliers, awareness or security in delivery.
- Security depends on individuals and needs a clearer, repeatable way of working.
What you receive
Useful work, with a clear purpose.
The deliverables are agreed around your needs. Depending on the scope, the work can include:
An awareness and human risk programme
A practical approach to helping people understand their security responsibilities, with relevant communications and clear ownership.
Supplier assurance and third-party risk processes
A proportionate approach to reviewing suppliers, recording concerns and assigning follow-up actions to the right owners.
Security built into delivery
Defined security responsibilities, review points and evidence requirements within your existing delivery processes.
An operating model your team can sustain
Agreed roles, working processes and supporting guidance, with a handover that makes ongoing ownership clear.
How we work
A clear scope and practical next steps.
Choose the capability
Agree the problem to solve, the intended outcome and the people and existing processes the work needs to fit around.
Build with the owners
Develop the agreed process and supporting material with the teams responsible for using and maintaining them.
Put it into use
Support the agreed introduction and handover, clarify responsibilities and identify how the team will review progress.
Common questions
Before you begin.
Do we need to build a whole security programme at once?
No. A project can focus on one capability, such as a process for supplier security assessments or a security awareness programme. Starting with a defined need makes the scope and responsibilities clearer.
Can the work fit our existing tools and processes?
The starting point is how your business already operates. The approach should reflect your team’s capacity and existing processes. Kurosec is independent and does not resell software.
What does embedding security into delivery mean?
It means making security responsibilities and review points part of normal delivery. For example, an agreed process can set out when a security review is needed, who makes decisions and what evidence to keep.
Who owns the capability after the project?
Your organisation retains ownership. Roles, supporting guidance and handover are agreed as part of the project. Ongoing direction can be provided through a separate fractional security leadership arrangement.
Your consultant
Independent security experience.
Kurosec is Haroon Mahmood's independent information security consultancy. Haroon brings more than 25 years of experience, including senior roles at Sun Microsystems, Oracle and Salesforce.
From Haroon's previous in-house work: Looking beyond the training completion rate.
About Haroon Mahmood