A protection strategy written before anyone was deployed

The situation

The client had been advised to put a detail on and had sensibly asked what it would be for. Nobody had assessed the threat, nobody could say what level of protection was proportionate, and there was no threshold at which it would increase or stand down.

The work

• The assessment came first and was written as a separate engagement, so the document deciding how much protection is warranted was not produced by the people whose revenue rises with the answer.
• The strategy set the escalation thresholds, the authority to change a plan, and what the client had agreed to: the three things that get renegotiated quietly when they are not written down.
• Only then was a detail scoped, against the assessment rather than against a feeling.

What was delivered

A protection programme the client could explain to their own board, and a cost that was proportionate to something written down.

This engagement is described by sector rather than named, and carries no outcome statistic, because a number nobody measured is not evidence. The other engagements · Talk to a consultant