People – the first and last line of defence
People are both an organisation’s strongest and weakest link.
- Provide continuous training: The majority of security breaches begin with phishing or social engineering. Conduct regular phishing simulations, awareness training and scenario-based exercises tailored to different roles.
- Do not focus solely on technical solutions: No IT system can resolve security weaknesses in business processes or employee behaviour. Executive leadership must understand that security resides within the organisation, not the IT department, and communicate this clearly throughout the business.
- Define clear responsibilities: Appoint a CISO or information security manager with a regular reporting responsibility to senior management.
- Mitigate insider threats: Introduce background checks, implement the principle of least privilege and monitor anomalous behaviour.
A security-aware and cyber-competent workforce is the most cost-effective security investment an organisation can make.
Processes – from incident response to continuous learning
Structured processes can transform security from a reactive activity into a proactive capability.
- Incident management: Establish a clear process for detecting, classifying and reporting incidents. Conduct exercises at least twice a year.
- Business continuity and recovery: Test backup and recovery procedures regularly. If it is not tested, it cannot be trusted.
- Risk management: Integrate risk assessments across the organisation in line with relevant frameworks and regulations. Link risks to tangible business objectives and ensure leadership understands the connection.
- Continuous improvement: Following every incident, vulnerability scan, penetration test and exercise, conduct a post-incident review and update procedures accordingly. Resilience is built through learning, not theoretical perfection.
Processes without testing are merely documentation. Exercises create capability.
Technology – build protection in layers
Technology forms the foundation, but it must support both people and processes.
- Zero Trust: Eliminate implicit trust. Implement multi-factor authentication, network segmentation and Privileged Access Workstations (PAWs) for administrators.
- Security monitoring: Deploy a SIEM (Security Information and Event Management) solution and a SOC (Security Operations Centre) for real-time monitoring and response.
- Patch and vulnerability management: Automate wherever possible, particularly across cloud and endpoint environments.
- Encryption and data protection: Encrypt data both at rest and in transit.
- Backup and isolation: Maintain at least one offline backup and test restoration procedures regularly.
A layered defence strategy reduces the likelihood that a single vulnerability will result in operational disruption or data loss.
Leadership and governance – from accountability to resilience
Boards of directors carry ultimate responsibility for cyber security under both DORA and NIS2.
- Governance framework: Combine ISO 27001 for structure and control with the NIST Cybersecurity Framework (NIST CSF) for practical implementation. ISO 27001 provides a robust management system framework, while NIST CSF offers practical guidance on implementing and measuring security controls.
- Measurable outcomes: Track KPIs such as Time to Detect (TTD) and Time to Recover (TTR).
- Audit and assurance: Conduct internal audits and, where organisational size and maturity allow, independent external reviews.
- Investment strategy: Budget for cyber security as an investment in organisational risk mitigation rather than as an IT expense.
Cyber security is a business leadership issue, not merely a technology issue.
Getting started
- Assess your current levels of protection across people, processes and technology.
- Conduct a gap analysis against relevant frameworks and regulations such as NIS2, DORA, ISO 27001/27002 or CMMC.
- Establish a security awareness programme and a dedicated CISO function.
- Implement Zero Trust principles across infrastructure and cloud environments.
- Test incident response capabilities through simulated attacks or red team exercises.
A cyber-resilient organisation does not know everything – but it knows how to respond quickly and effectively, and how to learn from real-world experience.