Gitte Pedersen

When mental health support depends on trust, data security becomes non-negotiable. Mental Health Innovations (MHI) runs Shout - a 24/7 text service that supports people in crisis across the UK. With highly sensitive data and zero tolerance for risk, they needed more than compliance. They needed cyber resilience. That’s why they turned to us. We helped MHI: 🛡️ Build a full security strategy from the ground up 💡 Provide VCISO support for high-level guidance 🏅 Achieve Cyber Essentials Plus & ISO 27001 🔏 Conduct annual pen tests & incident response exercises 🚨 Implement a Gold Retainer for rapid incident response We’ve worked side by side with MHI for years, supporting their evolution from a startup to a sector-leading organisation with a robust, proactive security posture - trusted by thousands in their most vulnerable moments. 👉 Read the full case study: https://okt.to/kHfhEU #CyberSecuritySolutions #MentalHealthSupport #DataProtection #CharityTech

21

UK ministers are calling on 19 key regulators, including the Information Commissioner’s Office, Financial Conduct Authority, Competition and Markets Authority, the Environment Agency, and Ofsted, to publish plans for how they will support the safe adoption of AI across their sectors. In a joint letter, the Technology Secretary Liz Kendall and Business Secretary Peter Kyle emphasised that safe, effective AI adoption depends on public trust and urged regulators to remove unnecessary barriers, act transparently, and ensure their processes are compatible with AI-enabled products. Do you think regulators are moving fast enough to keep pace with AI innovation? https://bit.ly/4cjBJ3N #ReedTechnology #AI #Regulation #ArtificialIntelligence #Innovation

2

Capita’s troubled Civil Service Pension Scheme hit by data breach | A data breach affecting 138 members of the Civil Service Pension Scheme piles pressure on the service's administrator, Capita, amid ongoing issues | Computer Weekly

1

Have you worked on a Cyber Security project as a Business Analyst? Most BAs haven’t. They’ve written “the system must support MFA”… …but they’ve never done the end-to-end BA lifecycle on a real security uplift... So I’m running a Mock BA Project Simulation inside my community... an end-to-end project implementing Multi-Factor Authentication (MFA). Over 6 weeks, we’ll cover the full BA lifecycle: → Initiation → Planning → Design → Delivery → UAT → Benefits Realisation And you’ll either: ➡️ produce the artefacts yourself (with my guidance) or ➡️ watch me build them and copy what “good” looks like Here’s the part people miss with MFA: Yes... we’ll do all the mandatory BA deliverables across the lifecycle… But we’ll also cover the MFA-specific BA work like: → MFA policy & rules (who/when/where) → approved authentication factors (app, SMS, FIDO2 etc.) → step-up triggers for high-risk actions → enrolment + login journey design → trusted device / re-auth rules → secure account recovery → exceptions + accessibility handling → logging/audit/monitoring requirements → adoption + success measures If you've ever wanted to get end to end experience, this gives you that... Or if you've wanted to get exposure to Cyber projects, this also gives you that... Would love to have you there - we kick off tomorrow! Link in my bio 🙂

130

21 Comments

In case you missed it, we commissioned a study of 500 Scottish businesses and the findings were picked up by The Scotsman. More than half fear they are vulnerable to a critical data breach, and fewer than one in ten provide regular cyber security awareness training for their staff. #Innovec

4

1 Comment

Great to see some clear direction being provided here by the NCSC. We’ve all seen the recent high profile breaches and their impact. Behind the headlines each week dozens of smaller firms are impacted by cyber security incidents - the advice from NCSC should be taken seriously by leaders of all UK businesses. The upcoming cyber security and resilience bill will hopefully be the wake up call some of these smaller firms need. If you’d like some help getting started, reach out! #cybersecurity #informationsecurity #cyberresilience

10

Quality assurance gets used as a catch-all phrase in education. It's worth being specific about what it means in practice. For centres delivering OCN London provision - Regulated qualifications, Bespoke qualifications, Access to HE Diplomas, supported learning qualifications, SEND employability programmes - QA isn't a compliance exercise. It's the system that makes every learner's achievement mean something. Every approved centre must have quality management systems covering assessment practice and internal quality assurance, and those systems have to be evidenced, not just documented. What matters about OCN London's approach is that it acknowledges context. A large FE college and a small voluntary organisation supporting SEND learners don't need identical systems - but the standard of rigour is the same. https://lnkd.in/epkgZhBK

9

We talk a lot about cyber resilience. Legislation forces us to prove it. The real challenge won’t be compliance, it will be turning policy intent into practical, day-to-day decision-making across government.

14

NEW: CyberNorth, the North East of England’s regional cyber security cluster, has appointed Helen Matthews to the role of Delivery Manager – Skills, as Danielle Phillips MBA FIIC officially steps into the role of CEO following the retirement of Phil Jackman. https://lnkd.in/ekXF4uqd #edtech #AI #CyberSecurity

19

44% of UK businesses report a basic cybersecurity skills gap. This shortage exposes organisations to: • Increased vulnerability to cyber threats • Challenges in achieving compliance standards • Hindered digital innovation Bridging this gap requires strategic hiring and investment in cyber security talent development. Our team can assist in identifying and attracting cybersecurity professionals on a permanent or temporary basis to strengthen your organisation’s security posture. Reach out to me on here or lauren@lhwpartners.com

1

Supply chain cyber security is now a top priority for the UK public sector. Download our new white paper to understand the ins and outs of the the Government Cyber Security Strategy (GCSS), regulatory expectations as they relate to third-party risk management, and how to build a more resilient supply chain ecosystem with Risk Ledger. 📘 Download the new guide to: ✅ Understand what GCSS & CAF mean for your organisation ✅ Learn how to put the principles into practice ✅ See how our supplier assessment framework maps against the GCSS https://hubs.la/Q03rR_JG0

5

Had some interesting searches recently that made me reconsider how I qualify profiles. One such example was for an IAM Risk Specialist position for a major German enterprise, and the client was looking for a very particular skill-set. With where they were in their projects, they needed someone who could deep-dive into IGA topics (JML, recertification, authorisation models, etc.). But one key area where many candidates were falling short wasn’t just technical, but around presentation skills. They needed someone who could work with senior leaders who were extremely time-poor and explain key issues quickly and concisely. I spoke to one candidate who I hadn’t considered straight away, as their CV didn’t quite match the key requirements. It looked more like general info-sec. But after chatting with them a few times, it was clear they had a talent to take topics that can be very complex and make you understand why they are important. They were also: - Proven to learn new topics quickly (But with a solid foundation of IAM knowledge) - Able to think on their feet quickly and make high level decisions for clients. During the interviews, the client was impressed with their unique approach and their range of wider skills, whilst showing the relevant expertise. Out of many candidates, he was the one who got the role. (Example of being unique; they even drew cartoons on a whiteboard at one point to explain core IAM processes to the hiring manager.) My point is if a candidate looks intriguing for a reason outside the core requirements, and I back them, it’s often worth a short chat. I’m not saying we should interview just anyone, but sometimes that 70–80% match can actually turn out to be an exceptional hire. Food for thought, at the very least. I’d love to hear businesses’ thoughts on this, what other factors do you look for outside pure IAM/Cyber skills? #IAM #IGA #PAM #IDENTITYACCESSMANAGEMENT

14

Always great to see feedback like this. One thing we often see is people confusing Business Continuity Planning with disaster recovery. Disaster recovery tends to focus on the immediate response to an incident, but BCP is much broader than that. It’s about how a business continues to operate in the days, weeks and even months that follow. In an uncertain and constantly evolving environment, giving organisations that structure and clarity can make a huge difference. Proud of the team for the work they do helping businesses prepare for more than just the first 48 hours.

13

Digital transformation is easier to manage when success metrics are defined early. Clear goals help teams prioritise, keep stakeholders aligned, and make delivery progress visible across the programme. NP Group supports transformation outcomes by aligning capability to delivery requirements, from specialist recruitment to professional services delivery. Whether you need permanent ownership, contract specialists for critical phases, or statement of work delivery support, we help you build capability that matches the outcomes you are measuring. If your team is setting Q2 KPIs now, we can support the resourcing plan behind them. Learn more at www.groupnp.com or get in touch at info@groupnp.com. #TransformationMetrics #DigitalTransformation #ProgrammeDelivery #WorkforcePlanning #TechLeadership #NPGroup

5

Thanks for sharing Garth Stinson Get the basics right with - Most successful cyber attacks exploit simple weaknesses: outdated software, weak passwords, missing backups. All of these are a control requirement for ISO27001 if you’re interested in reducing the threat of a cyber attack in your business, reach out to see how together we can make compliance a breeze!

2

I would like your feedback please relating to business accreditations and certifications (words that tend to be used interchangeable these days) for a company, as opposed to an individual. Do you think answering yes to ten questions and showing a few examples of how you put your responses into practice, a process that takes less than one hour, should be called an accreditation? And just to be absolutely clear, I am NOT talking about the difference between what is an accreditation and what is a certification, because most people use the words interchangeably. So while here I am talking about accreditation, I could interchange the word for certification. So, does the process mentioned really have any value as an accreditation (or as a certification)? A pledge, absolutely. But is that process really an accreditation..... Shouldn't business accreditations/certifications be robust and evidence-based? Doesn't anything less than that leave it open for box-ticking and a little bit of 'creativity!' Doesn't it muddy the waters in terms of what really is a worthwhile accreditation/certification? What do you think?

13

41 Comments

Stay ahead of cyber threats in the UK! Our quarterly Threat Intelligence Report is essential for keeping you informed on the latest cyber risks. Read insights into emerging threats and actionable recommendations to mitigate them. https://lnkd.in/e6bZWHsT

6