Cybersecurity
The first 24 hours of a cyber incident: what to do, and what not to
Decisions made in the first hours of an incident decide how much is lost, how long recovery takes and whether you can later explain what happened.
Governance, Compliance & Resilience
Policies, controls and evidence that satisfy auditors and regulators, and people who know what to do when an incident happens.
Overview
Boards are now asked directly by regulators and auditors how cyber risk is managed. The answer needs to be more than a folder of policies: a risk register that is actually used, controls that are tested, suppliers that are assessed, and metrics a non-technical director can follow. We build that programme, or run it for you as a virtual CISO.
We prepare organisations for ISO/IEC 27001 certification, PCI DSS and SWIFT CSP assessments and Central Bank of Oman requirements, using evidence from our own testing where possible. Resilience work then checks that plans hold up under pressure, through tabletop exercises for executives, restore tests and awareness training in Arabic and English.
What the service covers
| Service | Scope | Methods and outputs |
|---|---|---|
| Standards and certification | Gap assessments, implementation and audit readiness for ISO/IEC 27001, PCI DSS and SWIFT CSP. | ISO/IEC 27001, PCI DSS, SWIFT CSP |
| Regulatory compliance | Programmes aligned with Central Bank of Oman requirements and national cybersecurity frameworks. | CBO, National frameworks, NIST CSF 2.0 |
| Risk and policy | Cyber risk assessments, policies, third-party risk management and security metrics for the board. | Risk assessment, Third-party risk, Board reporting |
| Virtual CISO | An experienced security leader on call to run your programme without a full-time hire. | vCISO, Strategy, Roadmaps |
| Business continuity | BCP and disaster-recovery planning, impact analysis and testing. | ISO 22301, BIA, DR testing |
| Tabletop and crisis exercises | Scenario exercises for executives and technical teams, from ransomware to payment fraud. | Tabletop, Crisis simulation, Lessons learned |
| Ransomware readiness | Backup, recovery and decision-making tested before an attack, not during one. | Backup review, Recovery tests, Decision playbooks |
| Security awareness | Phishing simulations and training in Arabic and English for staff, executives and boards. | Phishing simulation, Role-based training, Board briefings |
How an engagement runs
Scope and rules of engagement
We agree objectives, scope, timing and authority in writing before any testing or monitoring starts.
Assess
We establish what you have, how it is exposed and what an attacker would target first.
Prioritise
Findings ranked by business impact, with a remediation plan your team can act on.
Protect and verify
Controls implemented, then retested to confirm the fix works.
Monitor and respond
24/7 detection, with a tested plan and our responders on call when an incident occurs.
From our insights
-
-
Cybersecurity
Payment instruction fraud in trade: how it works and how to stop it
A supplier's email asks you to send the next payment to a new account. The message is genuine-looking, the timing is right, and the money is gone within hours.
-
Cybersecurity
OT security in ports and plants starts with knowing what is on the network
You cannot protect a controller you do not know exists. In most industrial sites, the first useful project is an accurate inventory, collected without disturbing operations.
Talk to us about Governance, Compliance & Resilience
Send us the details and the practice lead will reply within one business day.