Governance, Risk & Compliance Consultancy

AI-related requirements

Where your responsible teams confirm requirements that apply to AI tools or use cases, we implement the supporting IT controls and evidence. Your legal, privacy and compliance specialists retain their assessments and applicability decisions. See AI governance on our AI consultancy page.

How a GRC programme is built

Governance, risk and compliance (GRC) connects who decides, which risks matter and how controls are evidenced. Each engagement is shaped around the scope you agree with us.

• Agree the scope: entities, locations, systems, information, interested parties, contractual commitments and relevant obligations.
• Establish governance: policy ownership, decision authority, roles, reporting and the review cadence.
• Understand and treat risk: a usable register, control gaps, treatment priorities and escalation.
• Build evidence: control owners, evidence locations, review dates and assurance responses.
• Manage supplier assurance: critical dependencies, access, contracts, available evidence and agreed follow-up.
• Support ISO 27001: readiness and implementation through our ISO 27001 consultancy.
• Prepare for cyber insurance questions through a separate cyber insurance readiness engagement.

Making risk decisions explicit

Risk appetite sets the level and types of risk leadership is prepared to pursue or retain. Tolerance translates that position into practical limits and escalation thresholds. Residual risk is the exposure that remains after existing or planned treatment.

A risk acceptance record should identify the risk, business impact, existing controls, remaining exposure, options considered, decision rationale, accountable owner, authorised approver, review date and events that require reconsideration. Use temporary acceptance where appropriate, with an expiry and follow-up actions.

Cloud Agile facilitates assessment and documentation. Your authorised leadership approves acceptance. Decisions must remain within legal, regulatory and contractual obligations.

We record the evidence and assumptions behind each judgement rather than presenting a single numeric score as objective certainty.

Typical agreed deliverables

• Scope and obligations register.
• Governance and responsibility model.
• Risk register and prioritised treatment plan.
• Documented decisions and exceptions requiring client approval.
• Policy and evidence improvement plan.
• Board or management reporting pack.
• Supplier assurance actions and a review calendar.

DORA: IT compliance and operational resilience

The Digital Operational Resilience Act (DORA) is an EU regulation that already applies to in-scope EU financial entities. Applicability depends on the entity, jurisdiction and service relationship; not every supplier to a financial entity falls under direct regulatory oversight. Your responsible teams and advisers confirm what applies.

Cloud Agile strengthens the IT foundations of your DORA programme, working alongside your internal teams and responsible advisers. We assess technical gaps, implement agreed controls and develop evidence for operational resilience.

• Map ICT dependencies, critical systems and third-party services.
• Implement and review access and security controls.
• Configure monitoring and escalation, including SOC support where agreed.
• Plan and run backup and recovery testing, with recorded results.
• Prepare incident readiness: roles, runbooks and technical evidence capture.
• Develop technical evidence for ICT supplier assurance.

CMMC: readiness and IT control implementation

The Cybersecurity Maturity Model Certification (CMMC) is a US Department of Defense cybersecurity assessment programme for the defence supply chain. It concerns Federal Contract Information (FCI), information provided or generated under a government contract that is not intended for public release, and Controlled Unclassified Information (CUI), sensitive information that requires safeguarding under law, regulation or government policy.

Before work starts, we agree the required level, the assessment boundary, delivery arrangements and data access requirements against your contracts. Controls are implemented against the NIST revision specified by the applicable programme and contract.

This is readiness and implementation support. Required self-assessments, authorised third-party assessments or government assessments remain with the appropriate responsible party. Cloud Agile is not a CMMC assessor or certification body and does not guarantee a certification outcome.

• Technical scoping and gap reviews against the applicable requirements.
• Access controls appropriate to FCI and CUI.
• Secure configuration, patching and vulnerability management.
• Monitoring and technical documentation to support assessment evidence.
• Remediation alongside your compliance team and assessment provider where required.

CIS Controls and CIS Benchmarks implementation

CIS Controls are a prioritised set of security safeguards; we work to the current verified version, presently v8.1. CIS Benchmarks are system-specific configuration recommendations, applied using the Benchmark appropriate to each product and version.

We agree priorities with you, implement and test changes, record approved exceptions, and maintain the agreed baseline through co-managed services. CIS alignment supports security improvement; it does not automatically establish regulatory compliance.

• Prioritise relevant CIS Controls safeguards for your environment.
• Apply CIS Benchmark configurations with testing before rollout.
• Document approved exceptions with owners and review dates.
• Review and maintain the baseline as part of ongoing co-managed delivery.

Who is responsible for what

Cloud Agile provides IT consultancy and implements the agreed technical controls. Your leadership and, where needed, legal, compliance, HR, privacy or other specialists retain responsibility for determining applicable obligations, wider organisational assessments and authorised risk decisions. Formal assessments follow the applicable assessment route. Risk acceptance cannot waive mandatory regulatory or contractual requirements.

UK certification pathways

Cyber Essentials and Cyber Essentials Plus are UK government-backed schemes. They remain available as distinct UK engagements, with their own pages linked below. Certification is assessed independently.