AVAKA Financial Services
South AfricaBoard-level cyber risk

Cyber governancePut cyber risk inside the organisation’s decision model.

We examine whether cyber risk is governed as an enterprise exposure, with clear ownership, risk appetite, oversight information and escalation from operational teams to leadership.

Discuss this serviceReview the scope
South African business environment representing cyber governance

Standalone service

Cyber governance

A review of cyber accountability, risk ownership, investment oversight and resilience governance.

Questions this service answers

A precise scope starts with the right question.

  1. 01

    Are cyber risk ownership and decision rights explicit?

  2. 02

    Can leadership connect cyber investment to material business exposure?

  3. 03

    Do reporting and escalation thresholds support timely action?

Defined outputs

Evidence designed for action.

Final coverage follows the agreed target, authority, materiality and evidence available. These are the core outputs around which the engagement is built.

  • 01

    Cyber governance and accountability map

  • 02

    Risk appetite and escalation assessment

  • 03

    Board reporting and metrics review

  • 04

    Governance improvement roadmap

Delivery discipline

A method that protects the conclusion.

  1. 01

    Context

    Identify critical dependencies

    Map the processes, systems, data and third parties the organisation relies on.

  2. 02

    Control

    Assess design

    Evaluate whether controls address the intended risk with clear ownership and evidence.

  3. 03

    Evidence

    Test operation

    Inspect configurations, records and populations to determine whether controls operated.

  4. 04

    Sequence

    Prioritise remediation

    Order actions around material exposure, technical dependencies and delivery capacity.

Reference points

Criteria agreed before testing begins.

  • COBIT and NIST reference points
  • POPIA
  • King V technology and information governance

Applicability and final criteria are confirmed during engagement scoping.

Also in Technology assurance

Related services

03.04Cybersecurity assessmentA risk-based assessment of cybersecurity governance, controls and resilience against defined outcomes.03.05Vulnerability assessmentStructured discovery, validation and prioritisation of weaknesses across in-scope technology assets.03.06Penetration testingControlled exploitation of defined attack paths under written authorisation and rules of engagement.

Start with the target

Define what this cyber governance needs to prove.

Request a scoping call