We help you make confident cyber risk decisions in the boardroom
The Bilateral Governance Assessment
This is a facilitated, board-level assessment that explains why cyber risk decisions are hard to make in your organisation — and what to do about it.
The diagnostic measures:
Board questioning quality
(clarity, challenge, proportionality, and decision focus)
against
CISO framing quality
(risk translation, options, trade-offs, and decision readiness)
Together, these two dimensions reveal your cyber governance state — and where decision friction is being unintentionally created.
What the assessment involves
A 2–3 hour onsite engagement with relevant board members, executives, and risk leaders, facilitated by an experienced practitioner.
During the session, we:
-
Examine how cyber risk is currently framed and challenged
-
Test the quality of questions being asked — and answered
-
Surface misalignments that are usually invisible in formal reporting
-
Map your organisation onto the 2×2 diagnostic framework
The session is practical, candid, and grounded in real decision scenarios.
What you receive
Following the engagement, you receive a written diagnostic report that includes:
-
Your current cyber governance state
-
Specific capability gaps across board challenge and executive framing
-
Clear, prioritised development recommendations
-
Practical guidance to improve decision quality — not just reporting quality
The outcome is more defensible, timely, and confident cyber risk decisions.
Who this is for
-
Regulated boards and board committees
-
CISOs and senior risk executives
-
Organisations where cyber risk is regularly discussed, but decisions are not owned
Why this matters
- PRA/FCA supervision increasingly scrutinises board cyber oversight quality
- DORA establishes explicit management body accountability, requiring demonstrable capability
- Only 3 in 10 directors rate their board’s cyber oversight highly (NACD, 2023)
- Most boards cannot evidence-informed challenge and decision-making despite regular briefings
Why this is different
This diagnostic does not assess controls, maturity, or compliance.
It focuses on the human and governance mechanics of decision-making — the point regulators ultimately care about.
Before improving cyber risk decisions, boards must first understand why they are hard to make.