Focus area · Cyber Security
Security by value, not by noise.
A severity score says nothing about what the business depends on. Value Governance ties every risk, weakness and control to the asset behind it, so security leaders see value at risk first.
The problem
The scanner shows how bad. Not how much it matters.
Thousands of findings arrive with a severity score each. Teams patch by score, the board asks about business impact, and the two conversations never meet.
Severity without context
A 9.8 on a test server outranks an 8.1 on the payment application, because nothing says which one the business runs on.
Controls in a separate world
The ISMS, the risk register and the vulnerability list live in different tools, so the status of a clause is a matter of opinion.
Evidence that goes stale
Test evidence is collected for the audit and forgotten until the next one.
The VGF lens
Security maturity, measured on the assets that carry value.
The Cyber Security competency is one of the four core competencies of the framework. Its five dimensions are assessed on each relevant asset, on the same 0–5 scale, and feed its maturity and so its value.
How the platform does it
One chain, from asset to evidence.
Asset, risk, weakness, remediation, control and evidence are linked records, so “why is this critical?” always has an answer and the ISMS runs on the same data as everything else.
Modules at work
What each part of the platform contributes.
Risks, controls, ISMS
Security risks, the control library, Statement of Applicability and test evidence, on the same records.
What depends on what
The inventory and its dependencies tell you which business services a weakness reaches.
Remediation on the clock
Fixes tracked against a deadline per risk level, overdue work first, then the most valuable assets.
Security incidents
Incidents linked to the assets and risks involved, prioritised by the value lost.
Go deeper
Cyber Security Competency Framework
The five dimensions, maturity levels and how they apply to each asset type.
Executive Overview
The framework, the formula and how to start, in a short read.
How value is measured
Ci, Mi, Vi and the value lost in an incident, step by step.
See your weaknesses ranked by value.
A walkthrough on sample data: from scanner findings to the assets they threaten, the controls that answer them and the evidence on file.