Governance and Risk

Security Frameworks and Controls Assessment

Tesserent has experience developed over many years, across all industries, in assessing, implementing and certifying information security systems against a wide variety of industry recognised standards

We partner with our clients to help select an Information Security Management System (ISMS) framework most appropriate for you, dependent upon the nature of your business, your objectives and the regulations in your industry. The more common standards include:

• CERT NZ Critical Controls.
• ISO27001:2013 – Information Security Management System
• Center for Internet Security (CIS) – Critical Security Controls Version 8
• National Institute of Standards and Technology (NIST) Cybersecurity Framework V1.1 / NIST 800-171R2 and others
• CPS234 – Security Standard (Regulated Entities)

Regardless of the cybersecurity risk management framework selected, we work with our valued clients to ensure that security controls are appropriate for your organisation's specific business objectives and strategies, circumstances, priorities and risk tolerances.

Risk Management

Accurately identifying and quantifying organisational risks assists in your organisation’s ability to mitigate threats, and manage risks, to a level acceptable to your circumstances.

Our Threat and Risk Assessment can assist you to examine the reality of the current external and internal threats, and the risks, to your organisation, its information, and information systems. We’ll then work with you on an appropriate control program.

We can assist in the assessment, development and implementation of Enterprise Risk Management frameworks based on industry standards and guidelines (i.e., ISO 31000 Risk Management), including all the required elements of:

• Risk Policy
• Risk Procedures
• Risk Registers
• Risk Appetite Statement and
• Associated processes across Information Technology and other areas of the organisation.

Security as a Service (SECaaS / CISOaaS / Analyst as a Service)

Hiring Freeze? Regulatory obligations? Insufficient in-house expertise? Board and governance demands? Short term projects?

Tesserent's Security as a Service (SECaaS) offering is designed to assist our clients to drive and enhance their security agenda and posture by providing a senior, experienced consulting practitioner to provide advice on a project or program basis. We’ll support your internal resources in the design and delivery of your overall security program.

Our security practitioners will work with your Information and Senior Management teams to support the achievement of your security goals including, for example, advice in following areas:

• Enterprise Risk Management
• Security Strategy Design and Development
• Governance and Control Frameworks
• Security Leadership Advice and Management Support
• Information Technology Audit and Control Programs
• Policy and Standards Design

In the establishment phase of the service engagement, we’ll collaborate with you to define and document the program of works to be completed.