Capability
Risk
Manage risks to fit your appetite. We make identifying, assessing, and treating risk a living discipline — not an annual spreadsheet — so your organisation takes the right risks, knowingly.
What this means
Risk management is how an organisation decides which risks to accept, which to reduce, and which to avoid. Done badly, it’s a register that gets updated once a year for the auditor. Done well, it’s the basis for every security decision you make.
We run it as a living discipline: identifying what could go wrong, weighing likelihood and impact against your risk appetite, deciding how to treat each risk, and tracking what’s left — continuously, and in language your board can act on.
Risk and Strategy together decide where to focus. Governance gives the work its mandate, Architecture & Transformation turns the treatment into structure, and Compliance assures it’s done right.
What’s included
The work that sits within Risk.
Under this capability
Risk disciplines and risk areas we manage.
From the core method to the specific risks your organisation faces.
Topic
Organised Cybercrime
The most likely cause of serious disruption for most organisations. We help you understand your exposure, prioritise defences, and govern your response — calmly and proportionately.
Explore
⟶
Topic
Supply-Chain & Third-Party Risk
Your security is only as strong as your suppliers'. We help you assess, govern, and continuously manage third-party and supply-chain risk — now a direct requirement under NIS2 and DORA.
Explore
⟶
Topic
Insider Risk
Not every threat comes from outside. We help you manage insider risk — accidental and deliberate — through governance, culture, and proportionate controls, handled with care.
Explore
⟶
Topic
Physical & Environmental Risk
Floods, fire, and power loss don't just damage buildings — they take systems and data offline. We help you understand and govern the physical risks to your IT, and plan for continuity.
Explore
⟶
Topic
Risk Management
The living discipline of identifying, assessing, treating, and monitoring risk — aligned to your appetite, so you take the right risks knowingly.
Explore
⟶
Topic
Risk Assessment
The rigorous, repeatable process of identifying and evaluating risk — likelihood, impact, and priority — so decisions rest on a clear picture, not guesswork.
Explore
⟶
Topic
Risk Treatment
Deciding and implementing how to address each risk — mitigate, transfer, avoid, or accept — and tracking what's left, deliberately rather than by default.
Explore
⟶
How it connects
Governance sets the foundation. Risk and Strategy decide where to focus. Architecture & Transformation puts it into structure. Compliance assures it’s done right.
Risk never works alone. It’s one of five capabilities we manage as a single, integrated function — your Managed Security & Risk Office.
Let’s make risk a living discipline.
We run your risk management as part of your managed office — so you take the right risks, knowingly.