Our Approach
Sopra Steria’s Cyber Governance and Assurance team consist of highly experienced security professionals covering a wide range of specialisms enabling the capture, understanding and advising on risk. This allows us to support our customers with skilled resources aligned to specific industry sectors, business requirements and role demands.
During an engagement, the initial activity is to capture and understand the customer requirements. This enables the assignment of the correct consultant to deliver the correct outcome. Once the deliverables have been established a plan to reach them is determined and details to the customer for approval and acceptance.
The Governance and Assurrance team understand the importance of meeting customer needs and expectations. Time is taken to capture and understand the requirements to then tailor an engagement that delivers an outcome of value that strengthens our customers’ security posture, this could be for a short term or long term period, the following are examples of specific capabilities that we can offer:
- Security Management; supporting or fulfilling CISO/Security Lead.
- Risk Management and Assurance.
- Security Maturity Assessments.
- Supply Chain Security.
- Information Assurance.
- Data Protection.
- ISMS (ISO 27001) Implementation and Audit.
- Operational Security management in BAU environment.
- Security Strategy and Direction Definition.
- Security Policy Development and/or Review.
- Security Process Development, Implementation and/or Review.
- Incident Management Guidance.
- Security Risk Assessment.
Security Assessments
Sopra Steria’s Security Assessment service is based on the use of questionnaires, interviews and workshops with relevant customer teams and third party providers. We recommend that it be evidenced based with depth of analysis ranging from a light
touch audit with anecdotal statements backed up by visibility of supporting documentation to a deep dive of processes and implemented controls in workshops combined with penetration testing and vulnerability scans available from Sopra Steria as additional
services.
Sopra Steria are experienced in the use of assessment tooling such as the Information Security Forum (ISF) Healthcheck tool, against the ISF Standard of Good Practice which is aligned with NIST Cybersecurity Framework, Center for Internet Security (CIS)
Top 20 Critical Security Controls V7.1, ISO/IEC 27002:2013, Payment Card Industry Data Security Standard (PCI DSS) and COBIT 5 for Information Security.
The assessment can be tailored to include control questions across a range of security categories, for example organisational controls, people controls, physical controls and technological controls the clauses from ISO/IEC 27001:2023.
We deliver this service through engagement with Senior management, Business Stakeholders, Technical and Service owners with a view to supporting the following outcomes:
- Determine the maturity of security programmes, processes and capabilities in place.
- Identify areas of strength and opportunities for improvement within these areas.
- Make recommendations to align security posture against industry best practice and business objectives.
- Initiate improvement based upon threat intelligence, current capabilities and engagement of key stakeholders.
A Security Lead will be allocated for each engagement to provide a point of contact and escalation path for any questions or issues that arise during the service. They will be responsible for overseeing the entire engagement and will be responsible for
delivering final report, executive presentations, and high level solution recommendations.
Each assessment would typically include the following activities;