What is the Contract Lifecycle Management and Why does it Matter? The future success of your business depends on realising the value that’s captured in its contracts. From vendor agreements to employee documents, everywhere you look are commitments that need to be met for your business to succeed. The type of contract and the nature of goods or services it covers will determine what sort of management activities might be needed at each stage. How your company is organised will also determine which departments or individuals are responsible for what activities at each stage. Contract Lifecycle Management, from a buyer's perspective, is the process of defining and designing the actual activities needed in each stage for any specific contract, allocating ownership of the activities to individuals or groups, and monitoring the performance of those activities as the contract progresses through its lifecycle. The ultimate aim is to minimise surprises, ensure the contracted goods or services are delivered by the vendor in accordance with the contract, and realise the expected business benefits and value for money. The Problem of Redundant Spend in Contracts Despite the built-in imbalance of information favoring suppliers, companies still choose to oversee these vendors internally. However, many adopt a reactive, unstructured approach to supplier management and struggle to bridge the gap between contractual expectations and actual performance. Currently, where governance exists, it is often understaffed, with weak, missing, or poorly enforced processes. The focus is primarily on manual data collection, validation, and basic retrospective reporting of supplier performance, rather than on proactively managing risk, relationships, and overall performance. The amount of redundant spend in contracts can vary widely depending on the industry, the complexity of the contracts, and how rigorously they are managed. For further information on this, Cambridge MC’s case studies provide insights into typical ranges and common sources of redundant spend. As a general estimate, industry analysts often state that redundant spend can account for as much as 20% of total contract value. In some cases, especially in poorly managed contracts, this can be much higher. What is AI-driven Contract Management? Artificial Intelligence (AI) is redefining contract management, transforming a historically time-consuming and manual process into a streamlined, efficient, and intelligent operation. Traditionally, managing contracts required legal teams to navigate through extensive paperwork, drafting, reviewing, and monitoring agreements — a process prone to inefficiencies and human error. With the emergence of artificial intelligence, particularly generative AI and natural language processing (NLP), this area of operations is undergoing a paradigm shift. This step change is not without concerns however, as there are the inevitable risks of AI hallucinations, training data biases and the threat to jobs. AI-driven contract management solutions not only automate repetitive tasks but also uncover valuable insights locked up in contract data, improving compliance and reducing the risks that are often lost in reams paperwork and contract clauses. Put simply, AI can automate, analyse, and optimise every aspect of your contract lifecycle. From drafting and negotiation to approval, storage, and tracking, AI-powered platforms enhance precision and speed across these processes; in some cases reducing work that might take several days to minutes or hours. By discerning patterns and identifying key terms, conditions, and concepts within agreements, AI enables businesses to parse complex contracts with ease and efficiency. In theory, this empowers your legal and contract teams (rather than reducing them), allowing personnel to focus on high-level tasks such as strategy rather than minutiae. However, it is important to recognise that none of the solutions available in the marketplace today offer companies an integrated supplier management solution, combining a comprehensive software platform, capable of advanced analytics, with a managed service. Cambridge Management Consulting is one of only a few consultancies that offers fully integrated Contract Management as a Service (CMaaS). Benefits of Integrating AI into your Contract Lifecycle Management Cambridge MC’s Contract Management as a Service (CMaaS) 360-degree Visibility: Enable your business to gain 360-degree visibility into contracts and streamline the change management process. Real-time Data: Gain real-time performance data and granularly compare it against contractually obligated outcomes. More Control: Take control of your contracts and associated relationships with an integrated, centralised platform. Advanced meta data searches provide specific information on external risk elements, and qualitative and quantitative insights into performance. Reduces Costs: By automating manual processes, businesses can significantly reduce administrative costs associated with contract management. AI-based solutions eliminate inefficiencies in the contract lifecycle while minimising reliance on external legal counsel for routine tasks. Supplier Collaboration: Proactively drive supplier collaboration and take a data-driven approach towards managing relationships and governance process health. Enhanced Compliance: AI tools ensure that contracts adhere to internal policies and external regulations by flagging non-compliant clauses during the drafting or review stage. This proactive approach reduces the risk of costly disputes or penalties. Reduces Human Errors: In traditional contract management processes, human errors can lead to missed deadlines and hidden risks. AI-powered systems use natural language processing to identify inconsistencies or inaccuracies in contracts before they escalate into larger issues. Automates Repetitive Tasks: AI-powered tools automate time-consuming tasks such as drafting contracts, reviewing documents for errors, and extracting key terms. This frees up legal teams to focus on higher-value activities like strategic negotiations and risk assessment. We can accurately model and connect commercial information across end-to-end processes and execution systems. AI capabilities then derive and apply automated commercial intelligence (from thousands of commercial experts using those systems) to error-proof complex tasks such as searching for hidden contract risks, determining SLA calculations and performing invoice matching/approvals directly against best-in-class criteria. Contract management teams using AI tools reported an annual savings rate that is 37% higher than peers. Spending and tracking rebates, delivery terms and volume discounts can ensure that all of the savings negotiated in a sourcing cycle are based on our experience of managing complex contracts for a wide variety of customers. Our Contract Management as a Service, underpinned by AI software tooling, has already delivered tangible benefits and proven success. 8 Steps to Transition Your Organisation to AI Contract Management Implementing AI-driven contract management requires a thoughtful and structured approach to ensure seamless integration and long-term success. By following these key steps your organisation can avoid delays and costly setbacks. Step 1 Digitise Contracts and Centralise in the Cloud: Begin by converting all existing contracts into a digital format and storing them in a secure, centralised, cloud-based repository. This ensures contracts are accessible, organised, and easier to manage. A cloud-based system also facilitates real-time collaboration and allows AI to extract data from various file formats, such as PDFs and OCR-scanned images, with ease. Search for and retrieve contracts using a variety of advanced search features such as full text search, Boolean, regex, fuzzy, and more. Monitor upcoming renewal and expiration events with configurable alerts, notifications, and calendar entries. Streamline contract change management with robust version control and automatically refresh updated metadata and affected obligations. Step 2 Choose the Right AI-Powered Contract Management Software: Selecting the right software is a critical step in setting up your management system. Evaluate platforms based on their ability to meet your organisation’s unique contracting needs. Consider key factors such as data privacy and security, integration with existing systems, ease of implementation, and the accuracy of AI-generated outputs. A well-chosen platform will streamline workflows while ensuring compliance and scalability. Step 3 Understand How AI Analyses Contracts: To make the most of AI, it’s essential to understand how it processes contract data. AI systems use Natural Language Processing (NLP) to interpret and extract meaning from human-readable contract terms, while Machine Learning (ML) enables the system to continuously improve its accuracy through experience. These combined technologies allow AI to identify key clauses, conditions, and obligations, as well as extract critical data like dates, parties, and legal provisions. Training your team on these capabilities will help them to understand the system and diagnose inconsistencies. Step 4 Maintain Oversight and Validate AI Outputs: While AI can automate repetitive tasks and significantly reduce manual effort, human oversight is indispensable. Implement a thorough process for spot-checking AI-generated outputs to ensure accuracy, compliance, and alignment with organisational standards. Legal teams should review contracts processed by AI to verify the integrity of agreements and minimise risks. This collaborative approach between AI and human contract management expertise ensures confidence in the system. Step 5 Refine the Data Pool for Better Results: The quality of AI’s analysis depends heavily on the data it is trained on. Regularly refine and update your data pool by incorporating industry-relevant contract examples and removing errors or inconsistencies. A well-maintained data set enhances the precision of AI outputs, enabling the system to adapt to evolving business needs and legal standards. Step 6 Establish Frameworks for Ongoing AI Management: To ensure long-term success, set clear objectives and measurable goals for your AI contract management system. Define key performance indicators (KPIs) to track progress and prioritise features that align with your organisation’s specific requirements. Establish workflows and governance frameworks to guide the use of AI tools, ensuring consistency and accountability in contract management processes. Step 7 Train and Empower Your Teams: Equip your teams with the skills and knowledge they need to use AI tools effectively. Conduct hands-on training sessions to familiarise users with the platform’s features and functionalities. Create a feedback loop to gather insights from your team, allowing for continuous improvement of the system. Avoid change resistance by using change management methodologies, as this will foster trust in the technology and drive successful adoption. Step 8 Ensure Ethical and Secure Use of AI: Tools Promote transparency and integrity in the use of AI-driven contract management. Legal teams should have the ability to filter sensitive information, secure data within private cloud environments, and trace data back to its source when needed. By prioritising data security and ethical AI practices, organisations can build trust and mitigate potential risks. With the right tools, training, and oversight, AI can become a powerful ally in achieving operational excellence as well as reducing costs and risk. Overcoming the Technical & Human Challenges While the benefits are compelling, implementing AI in contract management comes with some unique challenges which need to be managed by your leadership and contract teams: Data Security Concerns: Uploading sensitive contracts to cloud-based platforms risks data breaches and phishing attacks. Integration Complexities: Incorporating AI tools into existing systems requires careful planning to avoid disruptions and downtime. Change Fatigue & Resistance: Training employees to use new technologies can be time-intensive and costly. There is a natural resistance to change, the dynamics of which are often overlooked and ignored, even though these risks are often a major cause of project failure. Reliance on Generic Models: Off-the-shelf AI models may not fully align with your needs without detailed customisation. To address these challenges, businesses should partner with experienced providers who specialise in delivering tailored AI-driven solutions for contract lifecycle management. Case Study 1: The CRM That Nobody Used A mid-sized company invests £50,000 in a cutting-edge Customer Relationship Management (CRM) system, hoping to streamline customer interactions, automate follow-ups, and boost sales performance. The leadership expects this software to increase efficiency and revenue. However, after six months: Sales teams continue using spreadsheets because they find the CRM complicated. Managers struggle to generate reports because the system wasn’t set up properly. Customer data is inconsistent, leading to missed opportunities. The Result: The software becomes an expensive shelf-ware — a wasted investment that adds no value because the employees never fully adopted it. Case Study 2: Using Contract Management Experts to Set Up, Customise and Provide Training If the previous company had invested in professional services alongside the software, the outcome would have been very different. A team of CMaaS experts would: Train employees to ensure adoption and confidence in using the system. Customise the software to fit business needs, eliminating frustrations. Provide ongoing support, so issues don’t lead to abandonment. Generate workflows and governance for upward communication and visibility of adherence. The Result: A fully customised CRM that significantly improves the Contract Management lifecycle, leading to: more efficient workflows, more time for the contract team to spend on higher value work, automated tasks and event notifications, and real-time analytics. With full utilisation and efficiency, the software delivers real ROI, making it a strategic investment instead of a sunk cost. Summary AI is reshaping the way organisations approach contract lifecycle management by automating processes, enhancing compliance, reducing risks, and improving visibility into contractual obligations. From data extraction to risk analysis, AI-powered tools are empowering legal teams with actionable insights while driving operational efficiency. However, successful implementation requires overcoming challenges such as data security concerns and integration complexities. By choosing the right solutions, tailored to their needs — and partnering with experts like Cambridge Management Consulting — businesses can overcome the challenges and unlock the full potential of AI-based contract management. A Summary of Key Benefits Manage the entire lifecycle of supplier management on a single integrated platform Stop value leakage: as much as 20% of Annual Contract Value (ACV) Reduce on-going governance and application support and maintenance expenses by up to 60% Deliver a higher level of service to your end-user community. Speed without compromise: accomplish more in less time with automation capabilities Smarter contracts allow you to leverage analytics while you negotiate Manage and reduce risk at every step of the contract lifecycle Up to 90% reduction in creating first drafts Reduction in CLM costs and extraction costs How we Can Help Cambridge Management Consulting stands at the forefront of delivering innovative AI-powered solutions for contract lifecycle management. With specialised teams in both AI and Contract Management, we are well-placed to design and manage your transition with minimal disruption to operations. We have already worked with many public and private organisations, during due diligence, deal negotiation, TSAs, and exit phases; rescuing millions in contract management issues. Use the contact form below to send your queries to Darren Sheppard , Senior Partner for Contract Management. Go to our Contract Management Service Page

Nature means something different to everyone. For some, it is a dog-walk through the park; for others, it is hiking misty mountains in Scotland, swimming in turquoise waters, or exploring tropical forests in Costa Rica.

With the UK Budget being published tomorrow, councils are facing intense financial pressure. Rising demand for adult and children’s social care, homelessness services, and temporary accommodation has left little room for manoeuvre.

Press Release

Non-commodity charges are driving UK energy costs higher. Discover what’s changing, why it matters, and the steps businesses should take to protect budgets | READ NOW

Over the last few decades, carbon offsetting has become a go-to strategy for businesses looking to demonstrate sustainability commitments and enhance their external credibility. Offsetting takes many forms, from tree planting and forest conservation to providing communities with clean cookstoves and renewable energy.

In today's rapidly evolving business landscape, Environmental, Social, and Governance (ESG) factors have moved from niche considerations to critical drivers of long-term value, investor confidence, and societal impact.

Read our article on hidden complexity and find out how shadow IT, duplicate tools and siloed buying bloat costs. See how CIOs gain a single view of IT spend to cut waste, boost compliance and unlock 5–7% annual savings | READ FULL ARTICLE

Press Release

2 MIN READ

SMEs make up 99% of UK businesses, three fifths of employment, over 50% of all business revenue, are in everyone's supply chain, and are exposed to largely the same threats as large enterprises. How should they get started with cyber security? Small and Medium sized Enterprises (SME) are not immune to the threat of cyber attacks. At the very least, if your business has money then it will be attractive to criminals. And even if you don’t have anything of value, you may still get caught up in a ransomware campaign with all of your data and systems made inaccessible. Unfortunately many SMEs do not have an IT team let alone a cyber security team. It may not be obvious where to start, but inaction can have significant impact on your business by both increasing risk and reducing the confidence to address new opportunities. In this article we outline 5 key questions that can help SMEs to understand what they need to do. Even if you outsource your IT to a supplier these questions are still relevant. Some can’t be delegated, and others are topics for discussion so that you can ensure your service provider is doing the right things, as well as understanding where their responsibilities stop and yours start. Q1: What's Important & Worth Defending Not everything needs protecting equally. In your personal life you will have some possessions that are dear to you and others that you are more laissez-faire about. The same applies to your digital assets, and the start point for any security plan needs to be an audit of the things you own and their importance to your business. Those ‘things’, or assets, may be particular types of data or information. For instance, you may have sensitive intellectual property or trade secrets; you may hold information about your customers that is governed by privacy regulations; or your financial data may be of particular concern. Some of this information needs to be protected from theft, while it may be more important to prevent other types of data from being modified or deleted. It is helpful to build a list of these assets, and their characteristics like the table below:

Explore the rise of edge AI: smaller data centres, faster networks, and sustainable power solutions. See why the future of digital infrastructure is distributed and intelligent | READ FULL ARTICLE

Craig Cheney | The conversation around artificial intelligence (AI) in Government has shifted in recent years. The publication of the UK Government’s AI Playbook represents more than just updated guidance — it signals a huge shift in the government's approach to AI.

Discover why short-term thinking on sustainability risks business growth. Explore how long-term climate strategy drives resilience, valuation, and trust | READ FULL ARTICLE

The UK’s AI ambitions face gridlock. Discover how power shortages, costly electricity, and rack density challenges threaten data centre growth – and what’s being done | READ FULL ARTICLE

Delaying cybersecurity puts startups at risk. Discover how early safeguards boost investor confidence, customer trust, and long-term business resilience | READ FULL ARTICLE

An in-depth look at AI risk and governance: OECD frameworks, EU AI Act, and UK/US strategies reveal how nations balance innovation with safety and accountability | READ NOW

Discover how businesses can drive value through sustainability by focusing on compliance, cost savings, and credibility—building trust, cutting emissions, and attracting investors | READ ARTICLE NOW

This article explores the ‘Third Way’ to AI adoption – a balanced approach that enables innovation, defines success clearly, and scales AI responsibly for lasting impact | READ FULL ARTICLE

Discover how Deep Green, a pioneer in decarbonised data centres, partnered with Cambridge Management Consulting to expand its market presence through an innovative, sustainability‑driven go‑to‑market strategy | READ CASE STUDY

Discover how digital twins are revolutionising project management. This article explores how virtual replicas of physical systems are helping businesses to simulate outcomes, de-risk investments and enhance decision-making.

Cambridge Management Consulting (Cambridge MC) and Falklands IT (FIT) have donatede £3,000 to the Hermes/Viraat Heritage Trust to support the learning and development of young children in the Falkland Islands.

What’s your organisation’s type when it comes to cyber security? Is everything justified by the business risks, or are you hoping for the best? Over the decades, I have found that no two businesses or organisations have taken the same approach to cybersecurity. This is neither a criticism nor a surprise. No two businesses are the same, so why would their approach to digital risk be? However, I have found that there are some trends or clusters. In this article, I’ve distilled those observations, my understanding of the forces that drive each approach, and some indicators that may help you recognise it. I have also suggested potential advantages and disadvantages. Ad Hoc Let’s start with the ad hoc approach, where the organisation does what it thinks needs to be done, but without any clear rationale to determine “How much is enough?” The Bucket of Sand Approach At the extreme end of the spectrum is the 'Bucket of Sand' option which is characterised by the belief that 'It will never happen to us'. Your organisation may feel that it is too small to be worth attacking or has nothing of any real value. However, if an organisation has nothing of value, one wonders what purpose it serves. At the very least, it is likely to have money. But it is rare now that an organisation will not hold data and information worth stealing. Whether this data is its own or belongs to a third party, it will be a target. I’ve also come across businesses that hold a rather more fatalistic perspective. Most of us are aware of the regular reports of nation-state attacks that are attempting to steal intellectual property, causing economic damage, or just simply stealing money. Recognising that you might face the full force of a cyber-capable foreign state is undoubtedly daunting and may encourage the view that 'We’re all doomed regardless'. If a cyber-capable nation-state is determined to have a go at you, the odds are not great, and countering it will require eye-watering investments in protection, detection and response. But the fact is that they are rare events, even if they receive disproportionate amounts of media coverage. The majority of threats that most organisations face are not national state actors. They are petty criminals, organised criminal bodies, opportunistic amateur hackers or other lower-level actors. And they will follow the path of least resistance. So, while you can’t eliminate the risk, you can reduce it by applying good security and making yourself a more challenging target than the competition. Following Best Practice Thankfully, these 'Bucket of Sand' adopters are less common than ten or fifteen years ago. Most in the Ad Hoc zone will do some things but without clear logic or rationale to justify why they are doing X rather than Y. They may follow the latest industry trends and implement a new shiny technology (because doing the business change bit is hard and unpopular). This type of organisation will frequently operate security on a feast or famine basis, deferring investments to next year when there is something more interesting to prioritise, because without business strategy guiding security it will be hard to justify. And 'next year' frequently remains next year on an ongoing basis. At the more advanced end of the Ad Hoc zone, you will find those organisations that choose a framework and aim to achieve a specific benchmark of Security Maturity. This approach ensures that capabilities are balanced and encourages progressive improvement. However, 'How much is enough?' remains unanswered; hence, the security budget will frequently struggle for airtime when budgets are challenged. It may also encourage a one-size-fits-all approach rather than prioritising the assets at greatest risk, which would cause the most significant damage if compromised. Regulatory-Led The Regulatory-Led organisation is the one I’ve come across most frequently. A market regulator, such as the FCA in the UK, may set regulations. Or the regulator may be market agnostic but have responsibility for a particular type of data, such as the Information Commissioner’s Office’s interest in personal data privacy. If regulatory compliance questions dominate most senior conversations about cyber security, the organisation is probably in this zone. Frequently, this issue of compliance is not a trivial challenge. Most regulations don’t tend to be detailed recipes to follow. Instead, they outline the broad expectations or the principles to be applied. There will frequently be a tapestry of regulations that need to be met rather than a single target to aim for. Businesses operating in multiple countries will likely have different regulations across those regions. Even within one country, there may be market-specific and data-specific regulations that both need to be applied. This tapestry is growing year after year as jurisdictions apply additional regulations to better protect their citizens and economies in the face of proliferating and intensifying threats. In the last year alone, EU countries have had to implement both the Digital Operational Resilience Act (DORA) and Network and Infrastructure Security Directive (NIS2) , which regulate financial services businesses and critical infrastructure providers respectively. Superficially, it appears sensible and straightforward, but in execution the complexities and limitations become clear. Some of the nuances include: Not Everything Is Regulated The absence of regulation doesn’t mean there is no risk. It just means that the powers that be are not overly concerned. Your business will still be exposed to risk, but the regulators or government may be untroubled by it. Regulations Move Slowly Cyber threats are constantly changing and evolving. As organisations improve their defences, the opposition changes their tactics and tools to ensure their attacks can continue to be effective. In response, organisations need to adjust and enhance their defences to stay ahead. Regulations do not respond at this pace. So, relying on regulatory compliance risks preparing to 'Fight the last war'. The Tapestry Becomes Increasingly Unwieldy It may initially appear simple. You review the limited regulations for a single region, take your direction, and apply controls that will make you compliant. Then, you expand into a new region. And later, one of your existing jurisdictions introduces an additional set of regulations that apply to you. Before you know it, you must first normalise and consolidate the requirements from a litany of different sets of rules, each with its own structure, before you can update your security/compliance strategy. Most Regulations Talk about Appropriateness As mentioned before, regulations rarely provide a recipe to follow. They talk about applying appropriate controls in a particular context. The business still needs to decide what is appropriate. And if there is a breach or a pre-emptive audit, the business will need to justify that decision. The most rational justification will be based on an asset’s sensitivity and the threats it is exposed to — ergo, a risk-based rather than a compliance-based argument. Opportunity-Led Many businesses don’t exist in heavily regulated industries but may wish to trade in markets or with customers with certain expectations about their suppliers’ security and resilience. These present barriers to entry, but if overcome, they also offer obstacles to competition. The expectations may be well defined for a specific customer, such as DEF STAN 05-138 , which details the standards that the UK Ministry of Defence expects its suppliers to meet according to a project’s risk profile. Sometimes, an entire market will set the entry rules. The UK Government has set Cyber Essentials as the minimum standard to be eligible to compete for government contracts. The US has published NIST 800-171 to detail what government suppliers must meet to process Controlled Unclassified Information (CUI). Businesses should conduct due diligence on their suppliers, particularly when they provide technology, interface with their systems or process their data. Regulations, such as NIS2, are increasingly demanding this level of Third Party Risk Management because of the number of breaches and compromises originating from the supply chain. Businesses may detail a certain level of certification that they consider adequate, such as ISO 27001 or a System & Organization Controls (SOC) report. By achieving one or more of these standards, new markets may open up to a business. Good security becomes a growth enabler. But just like with regulations, if the security strategy starts with one of these standards, it can rapidly become unwieldy as a patchwork quilt of different entry requirements builds up for other markets. Risk-Led The final zone is where actions are defined by the risk the business is exposed to. Being led by risk in this way should be natural and intuitive. Most of us might secure our garden shed with a simple padlock but would have several more secure locks on the doors to our house. We would probably also have locks on the windows and may add CCTV cameras and a burglar alarm if we were sufficiently concerned about the threats in our area. We may even install a secure safe inside the house if we have some particularly valuable possessions. These decisions and the application of defences are all informed by our understanding of the risks to which different groups of assets are exposed. The security decisions you make at home are relatively trivial compared to the complexity most businesses face with digital risk. Over the decades, technology infrastructures have grown, often becoming a sprawling landscape where the boundaries between one system and another are hard to determine. In the face of this complexity, many organisations talk about being risk-led but, in reality, operate in one of the other zones. There is no reason why an organisation can’t progressively transform from an Ad Hoc, Regulatory-Led or Opportunity-Led posture into a Risk-Led one. This transformation may need to include a strategy to enhance segmentation and reduce the sprawling landscape described above. Risk-Led also doesn’t mean applying decentralised, bespoke controls on a system-by-system basis. The risk may be assessed against the asset or a category of assets, but most organisations usually have a framework of standard controls and policies to apply or choose from. The test to tell whether an organisation genuinely operates in the Risk-Led zone is whether they have a well-defined Risk Appetite. This policy is more than just the one-liner stating that they have a very low appetite for risk. It should typically be broken down into different categories of risk or asset types; for instance, it might detail the different appetites for personal data risk compared to corporate intellectual property marked as 'In Strict Confidence'. Each category should clarify the tolerance, the circumstances under which risk will be accepted, and who is authorised to sign off. I’ve seen some exceptionally well-drafted risk appetite policies that provide clear direction. Once in place, any risk review can easily understand the boundaries within which they can operate and determine whether the controls for a particular context are adequate. I’ve also seen many that are so loose as to be unactionable or, on as many occasions, have not been able to find a risk appetite defined at all. In these situations, there is no clear way of determining 'How much security is enough'. Organisations operating in this zone will frequently still have to meet regulatory requirements and individual customer or market expectations. However, this regulatory or commercial risk assessment can take the existing strategy as the starting point and review the relevant controls for compliance. That may prompt an adjustment to security in certain places. But when challenged, you can defend your strategy because you can trace decisions back to the negative outcomes you are attempting to prevent — and this intent is in everyone’s common interest. Conclusions Which zone does your business occupy? It may exist in more than one — for instance, mainly aiming for a specific security maturity in the Ad Hoc zone but reinforced for a particular customer. But which is the dominant zone that drives plans and behaviour? And why is that? It may be the right place for today, but is it the best approach for the future? Apart from the 'Bucket of Sand' approach, each has pros and cons. I’ve sought to stay balanced in how I’ve described them. However, the most sustainable approach is one driven by business risk, with controls that mitigate those risks to a defined appetite. Regulatory compliance will probably constitute some of those risks, and when controls are reviewed against the regulatory requirements, there may be a need to reinforce them. Also, some customers may have specific standards to meet in a particular context. However, the starting point will be the security you believe the business needs and can justify before reviewing it through a regulatory or market lens. If you want to discuss how you can improve your security, reduce your digital risk, and face the future with confidence, get in touch with Tom Burton, Senior Partner - Cyber Security, using the below form.