CLIENT CASE STUDY
Public Sector Supplier Health Check
Sector: Professional services | Size: Solo consultancy | Service: Full Health Check
Background
A UK-based consultancy with public sector clients engaged Metis GRC to provide a clear picture of its cyber security and data protection posture. The business delivers specialist project work and one-to-one client services, handling personal and sometimes sensitive client information. With no IT support and security habits that had grown over time, the owner wanted to understand the real risks, and how to reduce them without unnecessary complexity.
The challenge
The business had never had a security incident, but several concerns were starting to surface:
uncertainty about data protection obligations
blurred lines between personal and business technology
reliance on default settings in devices and online accounts
no structured approach to backups, continuity or incident response
limited visibility of how third-party tools handled client information
Our approach
Metis GRC carried out a Cyber Health Check based on the National Cyber Security Centre's Cyber Assessment Framework, widened to include the organisational, people and legal controls that small businesses often miss. A structured discovery call and follow-up review covered:
how client and project information moves through the business
how devices, accounts and cloud services are used
where protections were working, and where there were gaps
how the business would spot and respond to a problem
Outcome
We reviewed the business’s security, supplier arrangements and contractual obligations, producing a full report with an executive summary and a phased roadmap.
Each finding came with a plain-English explanation of the risk and a practical recommendation, prioritised from quick, low-cost fixes within 30 days to longer-term steps over the following year, including readiness for Cyber Essentials certification.
The owner now has an informed view of what matters most, alongside an achievable plan for a one-person operation that reflects the security expectations of government clients.
"I was apprehensive going in, expecting a critique of everything I wasn't doing. Instead, Aliya put me at ease from the start, with no judgement at all. The health check was far more thorough than I anticipated and went well beyond cyber security, identifying third-party, contractual and data protection risks I hadn't considered. I came away with a clear, practical plan I can work through on my own. It delivered real value and I'd recommend it to any organisation, particularly those working with government."
Founder, independent professional services consultancy
Want a clear picture of your own risks?
