Understand your current control environment The journey begins by identifying what controls currently exist within your organisation. Policies, procedures, and technical safeguards are reviewed and mapped against recognised governance, security, and privacy frameworks. Information is gathered to assess how controls are implemented in practice, helping leadership understand both strengths and potential risk areas. This stage helps address common uncertainties such as: • Do we have visibility of the controls currently in place? • Where are the most significant risks in our current environment? • What gaps or areas for improvement should be prioritised? Outcome You receive a clear, point-in-time assessment of your control environment and privacy practices, supported by structured findings and a concise risk snapshot. This can be used to support internal decision-making and, where appropriate, inform your organisation’s own discussions with brokers or insurers. For organisations referred by insurance brokers, this stage provides an independent assessment of current controls. It is not a certification or guarantee of control effectiveness, and it does not determine insurance outcomes.

Establish essential governance foundations Once the baseline is understood, the next step focuses on establishing fundamental governance aligned with SMB1001 Bronze-level controls. This stage ensures key policies, privacy obligations, and risk management practices are clearly documented and implemented. This stage helps organisations address common concerns such as: • Lack of documented policies • Uncertainty around privacy law obligations • Limited visibility into risk exposure • Difficulty demonstrating controls to insurers or partners Outcome Your organisation achieves baseline assurance, supported by documented controls, a defined risk register, and a structured assurance framework.

Turn governance into a repeatable operational discipline At this stage, governance moves beyond documentation into active operational processes. Incident response capabilities are established, supplier and third-party risks are assessed, and governance structures are introduced to ensure controls are monitored regularly. Rather than simply having policies in place, your organisation begins to operate risk management and compliance as an ongoing management function. This stage addresses common challenges such as: • Policies that exist but are not consistently followed • Lack of preparation for incidents • Unmanaged risks introduced by suppliers or third parties • Limited oversight of risk across the organisation Outcome Risk management and compliance become repeatable operational processes, supported by governance reviews, active risk monitoring, and structured maturity reporting. This stage represents Silver-level assurance, demonstrating operational capability and control effectiveness.

Provide board-level confidence in operational resilience Gold-level assurance focuses on delivering executive and board confidence in the organisation’s overall control environment. Controls are validated through structured evidence review and sampling, ensuring they operate as expected and are supported by clear documentation. Leadership receives formal assurance reporting, including management attestation confirming that governance processes are functioning effectively. This stage resolves common concerns such as: • Board uncertainty around risk exposure • Increasing due diligence from customers or partners • Greater scrutiny from insurers and regulators • The need to demonstrate mature governance Outcome Your organisation achieves Gold-level assurance, supported by evidence-backed reporting, executive attestation, and clear communication of control maturity to stakeholders.

Maintain resilience as your organisation evolves Assurance is not a one-time project. As organisations grow, adopt new technologies, and respond to evolving risks, controls must be continuously monitored and improved. The Continuous Assurance stage ensures that governance remains effective over time through regular reviews, performance metrics, and periodic recertification. This stage addresses ongoing challenges such as: • Governance initiatives losing momentum after implementation • Difficulty tracking long-term maturity • Changing risks as technology environments evolve • Ongoing insurance and partner assurance requirements Outcome Your organisation maintains sustained operational resilience, supported by recurring assurance reviews, executive reporting, and measurable improvements in control maturity.