Kurosec services
Security programme review
Get a clear view of your security programme and a practical plan for what to improve first.
Who it helps
Know where to focus your effort.
For business leaders and security leads who need an independent view of their current programme before deciding where to invest.
- Security responsibilities have grown, but priorities and ownership are unclear.
- An audit or customer review is approaching and you need to understand the gaps.
- You have inherited a programme and want to know what is working and what needs attention.
What you receive
Useful work, with a clear purpose.
The deliverables are agreed around your needs. Depending on the scope, the work can include:
A clear picture of the current programme
A review of the agreed policies, processes, controls and supporting evidence, informed by conversations with the people responsible for them.
Findings in business terms
An explanation of the gaps and risks that matter, including what is already working and where evidence is incomplete.
A prioritised improvement plan
Recommendations sequenced around business needs, dependencies and the capacity of your team, with proposed ownership.
Framework assessment where useful
Assessment against ISO 27001, NIST CSF or CIS Controls where agreed, with the framework and coverage chosen to match your needs.
How we work
A clear scope and practical next steps.
Agree the questions
Define the business context, areas to review, available evidence and the decisions the review needs to support.
Review the programme
Examine the agreed material and discuss how security works in practice with the relevant owners.
Make the next steps clear
Discuss the findings, test the recommendations with your team and set out a plan they can use.
Common questions
Before you begin.
Do we need an established security programme first?
No. A review can start with the policies, responsibilities and processes you already have. The scope should reflect your starting point and the business decisions you need to make.
Which framework should we use?
That depends on your business, customer requirements and existing commitments. Kurosec can assess against ISO 27001, NIST CSF or CIS Controls, with relevant UK NCSC guidance informing practical recommendations. The framework and depth of review are agreed before work begins.
Can a review include an ISO 27001 gap analysis?
Yes, where ISO 27001 is the agreed framework. A gap analysis compares the agreed scope with its requirements, identifies gaps in controls and evidence, and sets out priorities. It can support audit preparation but does not award certification or guarantee an audit result.
Can you help us act on the findings?
Yes. Implementation can be agreed as a separate project or supported through fractional security leadership. The review itself can also stand alone, with recommendations for your team to take forward.
Your consultant
Independent security experience.
Kurosec is Haroon Mahmood's independent information security consultancy. Haroon brings more than 25 years of experience, including senior roles at Sun Microsystems, Oracle and Salesforce.
From Haroon's previous in-house work: Turning an exercise into a programme of improvements.
About Haroon Mahmood