Give trustees a clearer view of digital and cyber risks before they become incidents.
Trustees may lack clear oversight of basic digital, cyber and information risks.
For: Small charities.
One governance-level digital and cyber readiness review covering oversight, asset and control questions, priority actions, ownership and specialist referrals.
Defined scope · evidence kept separate from assumptions · no unsupported outcome, certification or compliance claims
Trustees and managers get a governance-level view of the material digital and cyber questions, current evidence, ownership gaps and priority next actions.
Technical testing and certification remain outside the service; specialist issues are referred rather than hidden inside a governance checklist.
A trustee/management-level review of how digital, information and cyber risk is currently overseen and evidenced.
A structured set of questions covering the systems, information, responsibilities and basic controls material to the agreed review.
A proportionate action list separating immediate governance gaps from lower-priority improvements and specialist technical work.
Clear ownership for each agreed action so digital and cyber risks do not sit between trustees, staff, volunteers and suppliers.
Specific issues that require technical security, legal, privacy, insurance or other specialist input outside this governance-level review.
WORKED EXAMPLE
Example situation: Trustees may lack clear oversight of basic digital, cyber and information risks.
We would start with what is happening now and the information already available, then work through the service described on this page. If the problem needs a different route, we would say so before broadening the work.
A clearer result: Trustees and managers get a governance-level view of the material digital and cyber questions, current evidence, ownership gaps and priority next actions.
What you could receive: Governance review, Asset/control questions, Priority actions, Ownership, and Referral list.
Illustrative example — shown to explain how the service can be applied. It is not a customer testimonial or measured result.
Before anything is agreed, House of Carol confirms that the customer, problem, available information and requested scope are suitable for this service. If they do not, the work is narrowed, declined or routed rather than stretched beyond the product.
Trustee/management participation.
Current systems information.
Only the minimum information and access needed for the agreed work should be provided. Passwords, MFA codes, private keys and unnecessary confidential or personal data are not requested through ordinary messages.
Not penetration testing, technical security audit or certification.
Anything materially outside the agreed boundary becomes a separate decision rather than hidden expansion of the engagement.
The organisation fits the intended customer: Small charities.
There is an accountable customer owner able to provide the information and decisions the work depends on.
If the main need falls outside the stated deliverables or requires a specialist judgement House of Carol is not competent or authorised to provide, a different route is required.
The review does not guarantee cyber security or compliance and is not a technical security audit or certification. Trustees and managers retain the decisions.
FROM INTEREST TO A CLEAR DECISION
Start with the problem, not a purchase decision. We will check whether this service fits before anything is agreed.
Share the problem you are trying to solve, what you already have and any deadline or constraint that matters.
We check the scope, the information we would need, the fee and whether this is genuinely the right service. If it is not, we will say so.
Nothing starts until you know what is included, what is not, what you need to provide and what happens next.
There is no pressure to add another service. The useful next step is simply to decide whether this one solves the problem in front of you.
Start with the real problem
Tell us what is happening, what a useful result would look like and what information is already available. We will first establish whether this service fits before anything is agreed.