Assessment
Family cyber review
The whole digital position is rarely looked at in one piece. Each adviser and provider sees their own part of it: the IT company sees the office, the bank sees the account, the solicitor sees the documents. This review looks at all of it together, quietly, and puts the findings in writing.
What is reviewed
The scope is agreed in writing before the work starts. In most cases it covers the following.
- Identity and account recovery. How the accounts that matter are protected, who is able to reset them, and what someone would actually need in order to take one over.
- Email and domains. Mailbox security, forwarding and delegation rules, and the domains used by the family and the companies it owns.
- Devices across the family. The laptops, phones and tablets in use by the principal, the wider family and, where relevant, household staff.
- Household and home-office networks. Connectivity, guest access, cameras, building systems and anything else sharing the same network as work.
- Banking and payment controls. How payment instructions and changes to bank details are verified before money moves, and who is able to authorise what.
- Assistants and delegated access. What has been shared, with whom, on what basis, and what remains active after the reason for it has passed.
- Adviser communications. How documents and instructions travel between the family and its lawyers, accountants, bankers, trustees and corporate service providers.
- Backups. What is being kept, where it sits, who controls it, and whether restoring from it has ever been tested.
- Continuity. What happens if a key person is suddenly unavailable, and who else can reach the accounts, records and instructions the family depends on.
What you receive
The review is a bounded piece of work with a document at the end of it. The point of it is that when it is finished the family knows where it stands, in writing. It produces:
- A written report in plain language, readable by the principal and by advisers who are not technical.
- Findings ranked by consequence rather than by technical severity, so that what could cost the most money or cause the most disruption appears first.
- A prioritised remediation plan, sequenced so the work can be handed to whoever is going to carry it out.
- A session to take the principal, the family office or a nominated adviser through the report and answer questions on it.
Where the family wants it, a short awareness briefing for family members, assistants and household staff is delivered alongside the walkthrough, so the people inside the arrangements know what to watch for.
No credentials, devices or sensitive material are requested until the handling arrangements have been agreed. A good deal of the review can be carried out from conversations and observation before anything confidential changes hands.
Who asks for it
Principals, usually after something has prompted the question: an attempted fraud, a change in the family's circumstances, a move between countries, or the realisation that nobody has ever checked.
Family offices, where a small team holds responsibility for a great deal and wants an independent view of a position it inherited rather than designed.
Advisers, including private bankers, private client solicitors, trustees and accountants, who want a client's digital position looked at by someone who does the work personally and reports in writing.
What happens afterwards
The review ends with the report. Nothing further is assumed, and the plan is written so that it can be acted on without me.
Where existing providers are competent and willing, remediation can be carried out by them against the plan, and I am content to answer their questions while they do it. Where the family would rather the work was held together by one person with continuing responsibility, that is the private digital office retainer.
Where the review exposes a dependency on a single person, continuity mapping is the usual follow-on: a maintained record of the people, entities, assets, advisers, documents and access that keep the family's affairs running, with a written procedure for the first 72 hours.
Handling and discretion
A first conversation needs only an outline of the situation. Names, entities and figures are not required to establish whether a review is the right starting point. A non-disclosure agreement is available before anything substantive is discussed, and I am equally content to work under yours.
Findings are shared only with people the client names. I do not publish client names, case studies or testimonials, and I do not refer to one family's affairs in front of another. References can be provided privately where an introducer needs them.
Personally led
You deal with me and I do the work. Dead Simple Computing Ltd contracts and invoices the engagement, which is delivered within its applicable insurance and governance controls, while I personally scope, lead and substantially deliver the review.
Fees are separately scoped to reflect the size of the family, the number of businesses and properties involved, the countries in question and the level of discretion required.
Arrange a review
Outline the situation and the outcome you need. I will say plainly whether a review is the right starting point and what a sensible next step looks like.