Five lines of work

Problems we solve

• "We rolled out AI across the company and nobody can list what is in use." Copilots, embedded vendor features and staff-side tools multiplied faster than approvals — no register, no owner, and no idea which uses touch personal data or make decisions about people.
• "The board asked whether we comply with the EU AI Act and we could not answer." You do not need a legal opinion as much as a classification: which systems are prohibited, high-risk, limited or minimal — and what that obliges you to do.
• "A customer or partner sent us an AI due-diligence questionnaire we cannot complete." Enterprise procurement and partner onboarding now ask for AI governance evidence. Without an inventory and a policy, the deal stalls or the answer is guesswork.
• "An AI system influences decisions about people and we cannot explain it or show human review." Swiss data-protection law already gives individuals rights over automated decisions. You need the controls, not an apology.
• "Our AI vendors change models underneath us and we cannot track the risk." Model supply chains shift without notice; without third-party AI risk terms you inherit exposure you never assessed.

What we deliver

• AI System & Model Inventory — a live, risk-classified register of every AI use case, tool, model and vendor, with named owners, purpose, data categories, geography and lifecycle stage.
• AI Risk & Regulatory Classification — each system placed on the EU AI Act tier model and checked against Swiss data-protection and sector rules, with the resulting obligations mapped to an owner.
• AI Governance Operating Model & Policy Suite — the written rules and structures: AI policy, acceptable use, approval workflow, human-oversight design, roles and a governing body, built to ISO/IEC 42001 and the NIST AI RMF.
• AI Assurance & Audit-Readiness Pack — the evidence an independent party can inspect (testing and monitoring records, oversight logs, documented decisions), plus an AI-specific incident-response playbook and reporting duties.

Suited to

Boards, risk owners, compliance leads and CISOs deploying AI into decisions about people or into regulated processes.

Frameworks we work against

• EU AI Act — risk tiers and Art. 50 transparency duties
• ISO/IEC 42001 — AI management system
• NIST AI RMF
• Swiss nFADP / nDSG — automated individual decisions
• OECD AI Principles
• FINMA supervisory expectations for AI governance

How you know it worked

• A complete AI register exists, every entry has a named owner, and there is no unapproved AI in use.
• Every system carries a risk tier and either a "no action" rationale or a dated remediation plan.
• A written AI policy is formally approved by management, not drafted and shelved.
• An AI due-diligence questionnaire can be answered from documents, not reassembled in a rush.
• An evidence pack exists that supports an ISO/IEC 42001 gap analysis or a certification-readiness review by an accredited body.

Engagement shape

Four phases, run end to end. We agree the systems in scope and the accountable executive first, then work up from the register to a policy suite and an evidence pack.

1. Scope and mobilisation — agree the systems in scope, the risk criteria and the accountable executive.
2. Inventory and classification — build the register, classify every system, and produce the gap and remediation view.
3. Governance and policy build — operating model, policy suite, approval workflow, oversight and vendor-risk terms.
4. Assurance and readiness — evidence pack, incident playbook, and a documented readiness position against ISO/IEC 42001 or a customer due-diligence standard.

Entry point: Available as a fixed-scope entry engagement: a stand-alone AI Inventory & Classification Sprint that produces the register and the classification, and nothing else.

Related insight

• The EU AI Act Timeline: Two Deadlines Most Organisations Conflate

Problems we solve

• "We do not know which cyber rules apply to us." Is it the Swiss ISG, NIS2, DORA, the CRA, or none of them? Applicability depends on your sector, size, thresholds and EU footprint — and the answer changes the work by a factor of ten.
• "We want ISO 27001 and do not know what to fix first." Certification is a management-system project, not a tooling project. Without a gap assessment you buy controls in the wrong order and pay for it twice.
• "A customer's security questionnaire is blocking a deal." Enterprise procurement, insurers and EU customers now demand evidence — an ISMS, a risk register, testing, incident history. Missing proof costs revenue.
• "We have no register of our ICT suppliers and do not know what our contracts are missing." Third-party and cloud concentration risk is the commonest uncovered exposure, and DORA-style register fields and clauses are now the standard buyers expect.
• "Our incident plan has never been tested, and the reporting clock is short." A serious incident triggers reporting duties under the ISG, NIS2 and the CRA. An untested plan fails on the day it matters.

What we deliver

• Regulatory Applicability Map — a defensible, documented statement of which Swiss and EU regimes bind the organisation and why (ISG/KRITIS, NIS2, DORA, CRA, nFADP/nDSG and sector rules), with the obligations each one imposes.
• ISMS & Control Framework Blueprint — an ISO/IEC 27001-structured management system with controls selected from ISO/IEC 27002 and crosswalked to NIST CSF 2.0, delivered as a gap assessment plus a prioritised remediation roadmap to audit.
• ICT & Third-Party Risk Pack — a vendor inventory with criticality tiering, a DORA-style register of information, and review of the contract clauses that matter (security, audit rights, data location, incident cooperation, exit, subcontracting).
• Incident Response, Reporting & Resilience Plan — incident playbooks built around the real legal reporting duties, a tabletop exercise, and alignment with business continuity.

Suited to

CISOs, risk owners, compliance leads and boards accountable for cyber obligations and resilience testing.

Frameworks we work against

• ISO/IEC 27001 — information security management system
• ISO/IEC 27002 — control catalogue
• ISO/IEC 27005 — information-security risk management
• ISO 31000 — enterprise risk management
• NIST CSF 2.0 — Govern, Identify, Protect, Detect, Respond, Recover
• ISO 22301 — business continuity management
• NIS2 — EU critical-infrastructure obligations
• DORA — EU digital operational resilience
• EU Cyber Resilience Act (CRA)
• Swiss ISG / KRITIS incident-reporting duties to BACS

How you know it worked

• A management-approved applicability map states plainly which regimes bind the organisation and why.
• The control-framework gap position moves from a stated baseline toward target, and every open item has an owner and a date.
• A vendor register exists with criticality tiering, and contracts have been assessed against the clauses buyers and regulators now require.
• The incident reporting playbook has been exercised in a tabletop — the reporting clock has been rehearsed, not assumed.
• The organisation can enter a certification audit, customer audit or supervisory review with its evidence assembled.

Engagement shape

Four phases, run end to end. We determine which regimes bind you before any control work starts, so effort is not spent in the wrong order.

1. Scope and applicability — determine which regimes bind you; agree scope, boundaries and the accountable owner.
2. Gap assessment — measure current state against the chosen framework or frameworks and produce the risk-rated gap register.
3. Build and remediate — ISMS documentation, control-implementation support, vendor register and contract clauses, incident playbooks.
4. Audit readiness and pre-assessment — evidence review, dry run, and a documented readiness position ahead of certification or supervisory review.

Entry point: Available as a fixed-scope entry engagement: a Cyber GRC Applicability & Gap Review that answers "what applies to us, and how far off are we?".

Problems we solve

• Supply-chain and corridor exposure. A single chokepoint, port or border closure can idle a production line — and you hear about it from procurement, not from an early warning.
• Sanctions and export-control ambiguity. Obligations shift faster than counterparty screening; the cost of the wrong call is high.
• Market-entry and jurisdiction risk. Before committing capital you need to know whether the political and regulatory position in a country will still hold several years out.
• Expatriate and staff safety. People on assignment need a reasoned view of a location — not a news feed — and a trigger for when to escalate.
• Counterparty and third-party risk. Joint-venture partners, agents and local suppliers carry political exposure with no structured way to rate it.

What we deliver

• Country Risk Brief — a concise, structured assessment of a single country or region across political stability, conflict dynamics, regulatory/sanctions exposure and power realignment, with a Low / Elevated / High / Critical rating and named assumptions.
• Scenario Matrix — a two-track lines-of-play assessment, a base case and an adverse case, each with the trigger events that would move you from one to the other.
• Early-Warning Indicators — a short, monitored set of observable signals (political, regulatory, security, market) with review thresholds that tell you when a position is deteriorating.
• Exposure Mapping — your assets, suppliers, staff and contracts plotted against the geographies and chokepoints you actually depend on, ranked by risk.

Suited to

Firms with cross-border operations, investment exposure or supply chains in volatile regions.

Frameworks we work against

• Base-case / adverse-case lines-of-play method
• Low / Elevated / High / Critical risk-rating scale

How you know it worked

• A named decision made with a documented geopolitical rationale — not an unexamined one.
• Exposure that is ranked, so mitigation spend goes where risk actually sits.
• Adverse-case triggers that are monitored, so escalation starts early rather than after the event.
• A rating that can be defended to a board or regulator: assumptions named, sources of judgement stated.

Engagement shape

Entry product, standing advisory or project support. Every engagement states the decision it supports, the time horizon, the sources of judgement, and what would change the assessment.

1. Entry point — Board Reading: a single country or region brief with base and adverse cases, delivered as a written assessment and a decision session.
2. Standing Advisory — a defined set of countries or corridors monitored on a monthly or quarterly cycle, with early-warning indicators refreshed and ad-hoc questions answered.
3. Project or deal support — scenario matrix and exposure mapping scoped to a specific transaction, entry, relocation or board decision.
4. Method transparency — the decision supported, the horizon, the sources of judgement and the change triggers are stated in every deliverable.

Entry point: The Board Reading is the fixed-scope entry product: it lets you buy judgement before you buy a relationship, and it can be taken standalone or as a module within a core engagement.

Problems we solve

• State-linked threat relevance. Nation-state campaigns are reported constantly, but it is hard to tell which ones actually matter to your sector, your suppliers or your subsidiaries.
• Threat-actor jargon without translation. Advanced persistent threat reports are written for specialists; a board wants a plain view of who might target it, how, and why.
• Influence and disinformation exposure. There is often no structured way to see how coordinated information campaigns could hit reputation, people or brand in a target market.
• Sector-specific outlook. Energy, finance, defence-adjacent and logistics each have a different threat logic, and generic reporting does not say what to prepare for.
• Readiness under realistic pressure. Plans look fine on paper; what matters is how the organisation behaves when a complex, plausible scenario unfolds.

What we deliver

• Threat-Actor & TTP Landscape Brief — a plain-language map of the threat actors plausibly relevant to your sector and their observed tactics, techniques and procedures, drawn from public reporting and standard public frameworks.
• State-Linked Activity Assessment — an assessed view, not an assertion of fact, of state-linked or politically motivated activity in your sector or region, with confidence levels and the evidence the judgement rests on.
• Cognitive-Influence / IO Exposure Assessment — an examination of how coordinated information and influence activity could affect reputation, staff and operations in a given market.
• Sector-Specific Threat Outlook — a forward-looking outlook for one sector or region, naming the developments most likely to change the threat picture.
• Tabletop Exercise — a facilitated discussion exercise built around a plausible, sector-relevant scenario, to surface decision, communication and coordination gaps.

Suited to

Critical-infrastructure, industrial, defence-adjacent and multi-national organisations.

Frameworks we work against

• MITRE ATT&CK — public TTP reference
• ENISA threat landscape — public reporting category
• national NCSC advisories — public reporting category

How you know it worked

• A threat picture your board can act on, in language it can use.
• Defensive priorities set by relevance, not by the loudest headline.
• State-linked and influence risks named with honest confidence levels.
• Readiness gaps surfaced in exercise, not discovered in an incident.

Engagement shape

Advisory and analytic only: no offensive content, no incident response and no threat-hunting operations. Every assessment states what is known, what is assessed, and the confidence attached to each.

1. Entry point — Sector Threat Briefing: a focused briefing on one sector or region, delivered as a written note and an executive session.
2. Standing Threat Outlook — a recurring, forward-looking outlook with assessed judgements, refreshed on an agreed cycle.
3. Tabletop / readiness exercise — a scoped workshop with a written findings memo, covering cognitive readiness and decision-making rather than operational continuity.
4. Analytic discipline — attribution is only asserted where publicly established and sourced; otherwise it is written as assessed, with a confidence level.

Entry point: The Sector Threat Briefing is the fixed-scope entry product, and can be taken standalone or as a module alongside a core engagement.

Problems we solve

• Plans that have not been tested. A business continuity plan exists in a binder, but nobody has stress-tested it against a realistic scenario.
• Crisis coordination under pressure. When something serious happens, roles, decisions and communications become improvised.
• Recovery, not just response. Responding is one thing; the harder question is how and when operations return to normal.
• Learning that does not stick. After each incident the organisation promises to change things, but the findings do not turn into durable improvements.

What we deliver

• Business Continuity Plan (BCP) / Disaster Recovery Plan (DRP) design — built around your real critical functions, dependencies and recovery objectives.
• Crisis Cell Playbook — roles, decision rights, escalation and communication routines for the first hours and days.
• Tabletop Exercise — a facilitated scenario test with a written findings memo (operational continuity, distinct from the cognitive-readiness tabletop in the cyberwarfare line).
• Post-Incident Review — a structured, blameless review that converts findings into tracked corrective actions.

Suited to

Organisations whose continuity obligations outlast any single incident or leadership team.

Frameworks we work against

• ISO 22301 — business continuity management
• ISO 31000 — risk management
• incident-reporting duties under the Swiss ISG, NIS2 and the CRA

How you know it worked

• A continuity plan that is meant to be executed under pressure, not admired on a shelf.
• A crisis structure that has been rehearsed with the people who will execute it.
• Findings from exercise or incident that become tracked, owned corrective actions.

Engagement shape

A scoped project (plan design or exercise) or a periodic review under a light retainer. Positioned as the resilience backbone underneath the analytic lines.

1. Scoping — agree the critical functions, dependencies and recovery objectives in scope.
2. Design or exercise — build the continuity provisions, or test the existing ones under a realistic scenario.
3. Review — convert findings into tracked corrective actions and feed them back into the plan.

Entry point: Engaged as a scoped project or as a component within a broader governance and resilience engagement — offered as depth, not as the headline.