Risk, Impact & Harm Analysis

Systematically identify, evaluate, treat & monitor risks and opportunities across management systems

Select, qualify & control suppliers and outsourced processes across their lifecycle

Core concepts in preventive controls, including access management, cryptography, secure configuration & protective design

Core concepts in detective & corrective controls, including logging, monitoring, incident response, backup & recovery

Define clear ISO/IEC 27001 ISMS scope and boundaries and maintain a defensible Statement of Applicability (SoA)

Systematically assess, treat & document information security risks with traceable decisions in line with ISO/IEC 27001

Plan, implement & operate information security controls consistently in day-to-day activities in line with ISO/IEC 27001

AI uncertainty, limitations & common failure modes across predictive and generative AI systems

Assess AI impacts and harms, document findings, and connect them to risk decisions in an AI management system

Define, implement & maintain operational controls for AI systems across deployment, change and monitoring

Perform ISO 22301-aligned business impact analysis, identify critical activities, and define time-based recovery requirements

Privacy roles, obligations & controls in organisations, aligned with common national and international data protection requirements

Assess privacy risks, reason about impacts, and document DPIAs within an ISO/IEC 27701-aligned PIMS

Implement role-based privacy controls & data subject rights handling within an ISO/IEC 27701-aligned PIMS

Identify environmental aspects, evaluate impacts and significance, and maintain the assessment over time in an ISO 14001 context

Control operations in an environmentally sound and compliant manner in line with ISO 14001

Assess whether risk and opportunity management credibly informs organisational decisions and priorities

Evaluate asset-threat-vulnerability logic, risk treatment decisions, and traceability to controls and the Statement of Applicability

Evaluate harm, impact & risk reasoning, intended use alignment, and decision traceability in ISO/IEC 42001

Assess whether environmental aspects are identified, significance is judged credibly, and lifecycle perspective is applied in an ISO 14001 EMS

Assess whether business impact analyses produce credible recovery priorities and recovery objectives in an ISO 22301 BCMS

Evaluate whether privacy risk assessments and DPIAs produce credible risk understanding and prioritisation in an ISO/IEC 27701 PIMS