What is the Cyber Resilience Partnership?
It is a continuing cyber advisory and support relationship, shaped around your organisation. It can combine senior guidance, fractional cyber leadership and an agreed programme of reviews and practical activities, giving your priorities continuity beyond an individual assessment or project.
What can a partnership include?
Depending on your needs and scope, it can include strategy sessions, leadership and board advisory, fractional CISO support, risk and control reviews, programme coordination, Cyber Essentials renewal preparation, education, exercises, testing, plan refreshes and incident support. The agreement specifies what is included; every service is not automatically bundled into a retainer.
What does fractional CISO support mean?
A fractional Chief Information Security Officer, also described as a virtual CISO or vCISO, provides an agreed part time cyber leadership role. This can cover strategy, governance, risk priorities, leadership reporting, supplier oversight and guidance on security investment. Responsibilities, time and authority are agreed with your organisation; leadership retains its business decisions and accountability.
Do we need Cyber Compass before starting?
No. Cyber Compass is a useful way to establish your position and priorities, but you can start with an existing assessment, audit, roadmap or identified business need. We agree the starting point and any discovery required before shaping the partnership.
Can you work with our IT provider or internal team?
Yes. The partnership works alongside your team and providers, helping connect business priorities with technical ownership and delivery. We agree who advises, who implements and who checks the work. Specialist or technical activities are included only where specified, or commissioned separately.
Can the partnership support Cyber Essentials and maintain controls?
Yes. The agreed programme can include control reviews, change tracking, action reviews, evidence and scope refreshes, and Cyber Essentials renewal preparation. Certification and Cyber Essentials Plus assessment remain independent. Certification body charges, technical remediation and any separately commissioned preparation or assessment work are set out in the agreement or proposal.
Can incident response support be included?
Yes, where expressly agreed. Support can include incident advisory, decision support, coordination with your team and response providers, and defined investigation or technical assistance. The agreement sets the activities, included time, availability, contact route and any response commitments. A general retainer does not imply 24/7 monitoring, guaranteed emergency availability or unlimited response work.
How are the retainer and additional projects priced?
The fee reflects the role, included time, planned activities and support arrangements your organisation needs. We agree these in writing, together with the term and review arrangements. Work outside the retainer is separately scoped and approved before delivery; Security Foundations modules have individually itemised fixed prices. Third party charges are identified separately.
How do reviews and strategy sessions work?
We agree a frequency that fits your needs. Sessions can cover progress against the roadmap, current risks, changes to the business, control ownership, supplier dependencies and investment decisions. They help leadership understand what has changed, what needs attention and who owns the next actions.
Can the programme change as our business grows?
Yes. Regular reviews revisit priorities, organisational changes and the support that is most useful. We agree changes to activities, time, fees or incident arrangements together. A partnership can remain focused on one need or develop into a broader resilience programme.
