Risk, Impact & Harm Analysis

Build the capability to surface, structure and act on risk while action is still possible

Manage suppliers and outsourced processes across requirements, selection, onboarding, oversight, change and exit

Understand how preventive, detective and corrective controls work together across access, cryptography, monitoring, incident response, backup and recovery

Define clear ISO/IEC 27001 ISMS scope and boundaries and maintain a defensible Statement of Applicability (SoA)

Systematically assess, treat and document information security risks with traceable decisions in line with ISO/IEC 27001

Plan, implement and operate information security controls consistently in day-to-day activities in line with ISO/IEC 27001

AI uncertainty, limitations and common failure modes across predictive and generative AI systems

Assess AI impacts and harms, document findings, and connect them to risk decisions in an AI management system

Define, implement and maintain operational controls for AI systems across deployment, change and monitoring

Perform ISO 22301-aligned business impact analysis, identify critical activities, and define time-based recovery requirements

Privacy roles, obligations and controls in organisations, aligned with common national and international data protection requirements

Assess privacy risks, reason about impacts, and document DPIAs within an ISO/IEC 27701-aligned PIMS

Implement role-based privacy controls and data subject rights handling within an ISO/IEC 27701-aligned PIMS

Identify environmental aspects, evaluate impacts and significance, and maintain the assessment over time in an ISO 14001 context

Control operations in an environmentally sound and compliant manner in line with ISO 14001

Assess whether risk and opportunity management credibly informs organisational decisions and priorities

Evaluate asset-threat-vulnerability logic, risk treatment decisions, and traceability to controls and the Statement of Applicability

Evaluate harm, impact and risk reasoning, intended use alignment, and decision traceability in ISO/IEC 42001

Assess whether environmental aspects are identified, significance is judged credibly, and lifecycle perspective is applied in an ISO 14001 EMS

Assess whether business impact analyses produce credible recovery priorities and recovery objectives in an ISO 22301 BCMS

Evaluate whether privacy risk assessments and DPIAs produce credible risk understanding and prioritisation in an ISO/IEC 27701 PIMS