Cyber security does not work if it belongs to the IT department alone. We help you decide who owns the decisions, who carries the risk and how the subject reaches senior management.
And the board does not see the risk picture.
Such as essential cyber security controls.
That showed nobody was accountable.
The security officer role, reporting line and committee.
The minimum a sound programme needs.
What reaches senior management and when.
A short document with roles and decisions.
Built on your requirements.
Regular and brief.
And compare it with requirements.
With IT and the departments.
And adjust.
And review after a while.