TISA Hub

Cybersecurity & GRC

Understand your risks. Build stronger controls.

Bring technical security, governance and compliance work into a clear plan. We help you assess what is in place, prioritise what needs attention and design controls your team can own.

Discuss your requirementExplore capabilities

Technical assessments and advisory support, scoped to your environment.

A teal architectural frame around a frosted-glass shield, with indigo and magenta layers.
Assess exposureDesign controlsSupport readiness
Concept illustration · assets, access and security controls

Capabilities

See the risk.
Make the next action clear.

For security and compliance leaders, founders and CTOs who need a clearer view of risk, practical control design or support preparing for an applicable assurance requirement.

01

Security assessments & control reviews

Review architecture, identities, access, configuration and technical controls. Identify exposure and prioritise improvements against your systems and business context.

02

Governance, risk & advisory

Develop risk registers, policies, control ownership and internal audit plans. Use vCISO advisory support to guide decisions, review priorities and build a security programme.

03

Privacy & data protection

Map personal data, review handling and retention practices, and identify privacy controls. Support readiness work for applicable DPDP and GDPR obligations.

04

AI governance & risk

Assess AI use cases, data handling, accountability and human oversight. Support AI risk management and readiness against applicable ISO/IEC 42001 requirements.

05

Third-party risk

Structure vendor due diligence, review security evidence and identify dependencies. Build an approach to onboarding, risk acceptance and ongoing supplier review.

06

Compliance programme & readiness

Map requirements to controls, review evidence and address gaps for applicable ISO 27001 certification or SOC 2 examination readiness. Coordinate documentation and internal review.

What useful work looks like

Connect the finding
to the decision.

A useful assessment helps people decide what happens next. Possible deliverables connect technical findings to business impact, proposed ownership and a practical order of work.

Prioritised security assessment
Scope
Systems and boundaries
Findings
Evidence and risk context
Actions
Priority and rationale
Ownership
Proposed responsibilities

The excerpt shows a possible deliverable structure. Scope and acceptance criteria are agreed for your requirement.

Illustrative deliverable excerptSecurity assessment
Access control · example finding

Leaver access remains active.

An example account is still enabled after its owner has left. The removal process has no named review owner.

Evidence to review
Identity inventory, account status and the leaver record.
Risk context
Unnecessary access may remain available to business systems.
Proposed action
Review the account, remove unnecessary access and define a documented removal check.
Proposed owner
System owner, with People Operations supporting the leaver process.
Review before acceptanceValidate the evidence, impact and priority with the business owner.

Fictional example. A real assessment uses evidence from the agreed environment.

Where to start

A useful
first engagement.

These are possible starting points. We agree the deliverables and boundaries for your requirement.

Ways to engage

Choose how to engage.

  • 01

    Defined projects

    A specific output with an agreed scope.

  • 02

    Advisory support

    Focused guidance for a decision or review.

  • 03

    Ongoing operations

    An agreed operating scope and ownership.

Responsibilities, availability and support arrangements are established per engagement.

Start a conversation

Start with a security or GRC requirement.

Tell us about the environment, the concern or the review you are preparing for. We can discuss a useful starting scope.

Discuss your requirementcontact@tisahubs.com