Service 13
Cybersecurity & governance
Practical assessment and implementation for everyday business risk, with specialist referral for advanced testing and regulated environments.
Put sensible controls around accounts, devices, data, vendors and workflows.
What this can improve
What Trai can implement
- 01Security posture assessment
- 02MFA and access controls
- 03Data retention and vendor review
- 04Backup, recovery and response planning
What we can include in your project
We confirm the exact scope, provider requirements and costs in your proposal. These are possible inclusions, not an automatic bundle.
Authorised baseline review
Review business accounts, permissions, devices, backups and current practices within an agreed scope. This is not permission for intrusive testing of third-party systems.
Practical access controls
Implement suitable MFA, password-manager practices, administrator separation and staff onboarding or offboarding. Document ownership and recovery paths.
Data and supplier governance
Map where important records live, who needs access and which providers receive them. Agree minimisation, retention and review steps with the client and specialist advisers where needed.
Incident readiness
Create practical contact, escalation and recovery procedures. Coordinate backup restore checks and staff awareness; refer advanced investigation or testing to appropriate specialists.
A practical example
A staff member reports a suspicious login. The agreed plan identifies who secures access, who contacts the provider, how evidence is preserved and who obtains legal or specialist advice about any notification obligations.
What to bring to the first conversation
Bring the systems in scope, ownership and written authorisation, existing security providers and recovery contacts. Do not send passwords or incident evidence through the general enquiry form.
Common questions
Can you guarantee we will not be breached?
No. Controls reduce particular risks but cannot eliminate them. The scope, residual risks and ongoing responsibilities need to be understood.
Is this a penetration test or certification?
Not unless a separately qualified specialist is engaged under an explicit authorised scope. An everyday security review must not be presented as a formal certification or audit opinion.
What if we are dealing with an active incident?
Do not rely on the website enquiry form as an emergency response channel. Use your established incident contacts and provider support, and engage suitable specialist assistance.
Clear boundaries
Technology and implementation, with the right people involved.
Security access and testing require written authorisation. Advanced penetration testing and regulated work are referred to qualified specialists.
A useful place to start
What’s slowing your business down?
Bring the messy workflow, the missed calls or the system nobody trusts. We’ll help you find a sensible next step.