Approach
From what's wrong to what you do on Monday
A report tells you what's wrong. That's not much use if nobody tells you what to do next. For me, an engagement is only finished when you can answer four questions.
What you know at the end
What's wrong?
Not every deviation from a standard or a plan is a problem. I name what poses a real risk to your organisation, and I tell you what you can leave alone.
What do you do on Monday?
A first step with a name next to it. It's small enough to take straight away, and it makes the next step easier.
In what order?
What has to happen this month, what can happen this quarter and what can wait until next year. I order it by risk and by what your organisation can handle.
What does it cost?
For each measure, an estimate of time, money and people. Then you can choose without guessing.
How an engagement unfolds
Not every engagement goes through all five steps. Sometimes a baseline is enough; sometimes the work only starts at delivery.
-
Step 01 · position
First meeting
What happens
We talk about what's going on, who decides and what's already there. I tell you honestly whether I'm the right person. If I'm not, I'll say so.
What you get
A written proposal with the approach, scope and cost of the engagement.
-
Step 02
Baseline
What happens
I talk to the people who do the work, read what's on paper and look at how it works in practice. For a security question I assess against ISO 27001, the BIO, NIS2 or the GDPR.
What you get
An honest picture of where you stand, in language your leadership team can follow without explanation.
-
Step 03 · course
Direction
What happens
I turn what I've seen into choices. For each measure: why, who, when and what it costs. I always state a preference, and the reason for it.
What you get
A plan in order of priority that you can adopt and carry out.
-
Step 04
Support
What happens
I help your people with delivery. Sometimes I take on a temporary role, for example as programme lead, set-up lead or fractional COO.
What you get
Progress you can follow, and someone who adjusts course when the plan doesn't survive contact with reality.
-
Step 05 · beacon
Handover
What happens
I hand the work over to someone in your organisation: the documentation, the agreements and the reasons behind the choices.
What you get
An organisation that can carry on without me. I work towards that from day one.
What you can expect from me
Trust
One adviser, not a pyramid of juniors. You talk to the person who does the work.
Decisiveness
Advice with three options and no preference isn't advice. Mine always contains a choice.
Independence
My own interest is public: I'm co-founder and CEO of OneSpace Security, and I'll tell you as soon as that touches on your question.
Clarity
As little jargon as possible. If the leadership team doesn't understand it on first reading, it isn't finished.
How I put it in writing
The difference is in the risk a sentence takes. Each time, the safe version that says nothing comes first, then what you get from me. You can disagree with the second one, and that's exactly the point.
Cybercrime poses an ever-growing threat to organisations.
Your biggest risk isn't a hacker. It's that nobody knows who gets to say yes when things go wrong.
Based on our experience, we recommend an integrated approach.
I wouldn't tackle everything at once. Start with the two things that carry the most risk; the rest can wait.
We guide organisations through their digital transformation.
I start with the process that costs the most right now. Only then do we choose the software.
Contact
Wondering where you stand?
Arrange a first meeting. Email me a few lines about what's going on and I'll reply myself.
alex@arcturus-advisory.nl