Govern
Set ownership, expectations, policy, risk appetite and supply-chain responsibility so security decisions have authority and context.
BASTIONHOST / COMPANY SECURITY
COMPANY SECURITY
A security programme built around your actual risk.
I use the NIST Cybersecurity Framework as a practical way to understand the current position, agree the target and prioritise improvements. The framework supports the conversation; it does not replace judgment.
THE NIST VIEW
Six connected functions. One organisation-wide conversation.
NIST CSF 2.0 adds Govern to the familiar lifecycle and uses outcome-based language that can connect leadership, technology teams, operations and suppliers.
Identify
Understand critical services, assets, data, dependencies, vulnerabilities and the risks that could interrupt what matters.
Protect
Apply proportionate safeguards: access control, secure configuration, awareness, data protection, maintenance and tested backups.
Detect
Collect useful signals, monitor for adverse events and make sure somebody can understand and act on what the tools report.
Respond
Define incident roles, escalation, communications, analysis, containment and evidence handling before an event creates pressure.
Recover
Restore services safely, communicate clearly, learn from the incident and strengthen the organisation rather than merely returning to normal.
Framework reference: NIST Cybersecurity Framework 2.0 Resource & Overview Guide ↗
IT / OT CYBER RISK
Protect the critical service, not only the office network.
Information technology and operational technology often share identities, suppliers, remote access and business consequences, even when their change cycles, safety requirements and recovery constraints are very different.
Map the service end to end
Connect business services to people, data, networks, operational assets, physical processes and third parties so hidden dependencies become visible.
Control the shared boundaries
Review identity, privileged and vendor access, remote support, segmentation, maintenance routes and monitoring without disrupting safe operations.
Plan for safe response and recovery
Coordinate cyber, operational, safety, communications and supplier roles, then test recovery against the conditions the organisation will face in practice.
FILTER THE HYPE
Before buying a security product, improve the question.
Vendor claims often begin with a threat and jump directly to a product. A useful decision begins with the risk, the outcome and the operational reality.
Which specific risk or NIST outcome does this improve?
What evidence supports the claimed improvement?
Who will own, operate and respond to the product every day?
What data, access and integration does it introduce?
What are the false positives, gaps and failure modes?
What is the full cost—including people, support and exit?
My rule
No tool compensates for unclear ownership, unmanaged assets, weak access control, untested recovery or an organisation that is afraid to report mistakes.
PRACTICAL SUPPORT
Turn the framework into decisions and a manageable roadmap.
Current profile
Understand material risks, current outcomes, dependencies and gaps without creating a compliance theatre exercise.
Target profile
Agree what good needs to look like for this organisation, its obligations and its risk tolerance.
Prioritised roadmap
Sequence improvements by risk reduction, dependency, effort and the organisation’s ability to sustain them.
Decision support
Challenge vendor proposals, clarify ownership and give leaders the information needed to make defensible choices.
MAKE THE NEXT STEP PROPORTIONATE
Start with the risk—not the product.
When capacity allows, I offer voluntary help to establish a NIST-led current position, challenge a proposed investment or shape a practical security roadmap that leadership and delivery teams can own.
Start a conversation →