Skip to main content
Fleur Lamont Logo Fleur Lamont

Technology Risk Framework

The European Technology Risk Assessment, worked through for one organisation, with a document you own.

You already have, or can download, the framework. What you do not have is it applied to your systems, your data and your suppliers, with the findings written down and walked through. That is the £1,900 job.

Where this sits on the ladder

There are four rungs, and this is the top one.

1. The free guide: ten checks for operational continuity, on one page, free. The guide covers the morning the till stops.

2. The Guided Session (£450, ninety minutes). The ten checks filled in for your kit: one page of answers, a backup test, and you leave knowing what to do first. For an owner with no IT.

3. Risk Discovery (£950, a full day). The wider technology risk landscape opened up: the suppliers you depend on, the data flows you don't see, the regulatory gaps, the things that could break next quarter. For a firm with one IT person or an MSP, where I do the asking and the translating. You get a 5 to 10 page written assessment and a walkthrough, without the full framework.

4. Technology Risk Framework (£1,900): the European Technology Risk Assessment framework worked through for your organisation, domain by domain, and in depth. For a firm with a real IT team and a board that asks.

The Guided Session gives you one page of answers and a backup test. Risk Discovery gives you the picture, in your language. The Technology Risk Framework gives you 15 to 30 pages, a remediation plan with owners and dates, and a document you can show to a board, an insurer, or a customer who asked.

What happens

We go through the framework one domain at a time, and I ask the questions the framework asks: what you run, where the data sits, who can reach it, what happens when a supplier goes down, and what you would do if the answer you rely on turned out to be wrong. You answer, or you point me at the person who can. It is a structured conversation, not an interrogation, and most of it is things you already know once somebody asks them in order.

We do it on a call, or on site in the North East. At the end you get the findings written down, ranked, and a walkthrough so the document is useful rather than filed.

What you get

  • The framework worked through for your organisation, domain by domain, on your systems, your data and your suppliers.
  • A named line on power, utilities and cold-chain continuity: what a power or water outage does to the site, what the cold chain and any powered medical equipment need, and what it costs to fix.
  • A written assessment, normally 15 to 30 pages depending on how many domains are in scope, with the findings ranked by likelihood and impact, so the first things come first and the rest follow in order.
  • What is inside it: scope and method, what your organisation actually runs on, the findings with the evidence behind them, the gap against the framework and against the regulation that reaches you, a remediation plan with owners, dates and costs, a supplier and exit list, your incident one-pager, and a date to look again.
  • A one-page summary of the whole thing, so a board, an insurer or a customer who asked can read your position in two minutes.
  • A walkthrough session, so you are not handed a document and left with it.
  • A document you own, in a form you can share with a board, an insurer or a customer who asked.
  • A note of what was out of scope, so nothing is implied that we did not cover.

Who this is for

An organisation with one specific technology risk question it needs answered and written down. Often that is a board, an insurer, a customer's due diligence, or a tender that asked for it. Owner-run firms in the North East, and larger operations where the office is small and the consequences are not.

Practically: a firm with a real IT team. If you have one IT person or an MSP and nobody who thinks in risk language, start at Risk Discovery (£950) instead: a full day, and I do the translating. If you are an owner with no IT at all, the Guided Session (£450) is the right rung.

Who this is not for

  • Anyone after a penetration test or a technical security audit. This is a risk framework, and it is not a test of your defences.
  • Firms that want a certification. This does not certify you against any standard.
  • Anyone who wants me to run the build. This is assessment and advice, and then you own the next step.
  • Firms that want a two-hundred page report. You get a document you can act on, normally 15 to 30 pages.

Price

£1,900 fixed fee, payable on delivery. No subscription and no retainer. Remote, or on-site in the North East.

If £1,900 is more than you need yet, Risk Discovery is a full day at £950 for the same questions without the full framework worked through domain by domain, and the Guided Session is £450 for continuity only.

Ask about the Technology Risk Framework

Tell me the question you need answered, and I will tell you whether this is the right way to answer it.

If £1,900 is more than you need yet, Risk Discovery is the rung below: a full day at £950, a written assessment of your technology risk, and a walkthrough.

Common questions

Is this the same as the free ebook? No. The European Technology Risk Assessment is the free ebook, free to download, and it stays free. This is that framework applied to your organisation, with the findings written down and walked through.

What is the difference between this and Risk Discovery? Risk Discovery is a full day (£950) where the questions get asked and answered and I translate the answers into risk, ending in a 5 to 10 page assessment and a walkthrough. The Technology Risk Framework (£1,900) is the deeper version, with the framework worked through domain by domain and a 15 to 30 page document you own.

Do you need access to our systems? Only what you choose to share. Most of this is a structured conversation, and I do not take copies of your data away.

How long does it take? It depends on how many domains are in scope and how quickly the people who hold the answers are available. We agree the scope and the dates before we start, so there is no moving target.

How is this different from the free guide? The guide is ten checks for continuity, the morning the till stops. This is the wider technology risk framework, and it is the version written down for you.

Is this anything to do with insurance? The framework covers the things an insurer asks about when a firm claims. But I do not sell insurance and I am not a broker. The assessment is about knowing where you stand before anyone needs to ask.

If the question is continuity rather than the wider picture, the Guided Session is the smaller first step. The framework behind this work is the European Technology Risk Assessment, the free ebook, free to download.