Fractional CISO · Framework readiness
I'm a fractional CISO: one senior adviser with more than 25 years across IT services, security and risk, working with organisations of every size, in technology and well beyond it. I help you see where you are exposed, get ready for the frameworks your customers ask about, and prepare for the day something goes wrong.
What I do
Most of my work starts with a question a founder, executive or director is already asking. These are the ones I hear most.
I look at how your business actually runs, from your people and suppliers to your systems and data, and tell you, plainly, where the real exposure is and what is already in good shape.
A short, honest picture of where you stand, and what to do first, next and later.
I brief your board or investors in plain language: what has changed, what worries me, and what is being done. I also help directors work out which questions to ask, and what a good answer sounds like.
A board and investors who understand the risk, and a conversation rather than a slide deck.
When a technology choice carries risk, such as a new system, a new supplier or a change in how you work, I give you an independent view before you commit.
An independent second opinion before you commit.
When a customer questionnaire, a tender, an investor's due diligence or an insurer asks about security, I help you work out what they really need, and what a proportionate, truthful answer looks like.
Answers you can stand behind, and fewer deals stalled on security.
Your people are already using AI tools, and your suppliers are building AI into the systems you rely on. I help you decide where AI is worth using and where it is not, and put sensible guardrails in place: a short AI policy people will actually follow, clear rules about what information goes in, and the right questions to ask suppliers.
Clear rules for AI that people follow, and leadership that knows where AI is in use.
I help you plan for the bad day before it comes, and rehearse it until people know their part. More on this below.
Response, recovery and continuity plans your people have actually practised.
Framework readiness
Sooner or later a customer, a tender, an investor or your sector asks you to meet a recognised security framework. Whichever one it is, the work follows the same path, sized to your organisation rather than copied from a textbook.
FIRST
I read the framework against how your business actually runs, and separate what it truly requires from what people assume it does, so you know the real size of the job before you commit.
THEN
A prioritised plan for the policies, controls and habits that meet the requirement, in an order that suits your team, without building a bureaucracy around it.
READY
When the questionnaire, the due-diligence request or the assessor's questions arrive, you can answer them truthfully, and show what is in place.
When people call me
Few organisations go looking for security leadership. Something happens that makes the question hard to ignore.
A long list of questions, a deadline, and a deal that depends on the answers.
I help you answer truthfully, and fix the gaps that would otherwise stall the deal.
The contract you want requires you to meet a security framework you have never worked with.
I tell you what it really involves and how long it takes, then get you ready.
The data room has a security section, and nobody on the team owns it.
I help you give an honest picture, and a credible plan for what is still open.
Your IT provider or your developers are confident, but nobody can show you why, and you are the one accountable if they are wrong.
I check what is really in place, alongside them, not against them.
The questions about backups, passwords and email security are getting harder, and the premium is going up.
I help you answer truthfully, and fix the gaps that cost you most.
Someone used a free AI tool to summarise a client file, and now you are wondering what else has gone in, and where it went.
I help you set sensible rules for AI, and check what your tools do with your data.
Resilience
Most organisations have backups and an IT provider, but no agreed answer to "what do we do now?" I help you write three short, practical plans, then practise them until they hold.
IRP
The first hours of a cyber incident: who leads, who decides, who you call (your IT provider, insurer, bank and lawyers), what you say to staff and customers, and who you may need to notify.
DRP
How you get systems and data back, in what order, and how quickly. I help you agree realistic recovery targets with the business, then check that your backups actually restore, not just that they run.
BCP
How you keep trading while systems are down or a key supplier, site or person is unavailable: your critical activities, the workarounds, and the decisions leadership will face.
A plan nobody has rehearsed is a document, not a capability. I design and run exercises around the scenarios that matter to your business, then write up what we learned and what to fix. Customers, insurers, investors and boards increasingly ask whether plans have been tested; this is how you can say yes.
How I work
I work on my own, fractionally, with a small number of organisations at a time. Every engagement starts with a conversation, and you can stop whenever the advice has done its job.
In proportion.
Safeguards sized to your organisation, not copied from a textbook.
In plain language.
Advice you can act on, not a report to file.
Alongside your team.
I work with your IT provider or engineers, not around them.
Directly.
You deal with me, and I do the work myself.
Questions
No. Your IT provider keeps your systems running; I help you decide what matters and check that it is in place. I work alongside them, and most providers welcome a clear brief.
Whichever one your customers, your sector or a tender asks for. The work always starts by understanding what that framework really requires of a business like yours, and I hold lead auditor qualifications, so I know what an assessor will look for.
You tell me what prompted you to get in touch, I ask some questions, and we work out together whether and how I can help. You do not need to prepare anything.
Usually not. Most of my work comes from conversations, your existing documents, and what your IT provider can show us. Where a technical check is worthwhile, I arrange it with your provider.
You get a CISO's experience for the time the work actually needs, not a full-time salary. We agree the scope before anything starts, and it ends when the job is done.
We agree the scope and the fee before any work starts, so you know where you stand.
Yes, always. If you would like a confidentiality agreement in place before we talk in detail, I am happy to sign one.
If you are dealing with a live cyber incident, contact your IT provider and your insurer first, because many policies include an incident response line. You can also call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) or report it at cyber.gov.au. Then send me a message below, starting with "urgent".
Contact
Tell me a little about what is on your mind. A few sentences is plenty.