ORGSEC+ · Step 3 of 4
ImproveImprove
The measures are carried out as competence programmes, training, exercises and analyses where the review shows the need – by us, or by whoever you choose.
In ORGSEC+Competence programmes, simulation and digital tabletop exercises · carried out digitally
Measures where the review shows the need, not a fixed package
The measures in the plan are carried out where the review shows the need, not according to a fixed package. For some it is about plans and continuity, for others about cyber preparedness, and for many about the human layer: that those who must handle an incident have trained together and know what to do without searching through a plan.
ORGSEC delivers the measures digitally, as competence programmes adapted to roles, simulation for teams and key personnel, digital tabletop exercises for the leadership team, and analyses where needed. Everything builds on the ORGSEC method, so that what you carry out also strengthens culture, training and leadership in the organisation, and not only the documentation.
You can also choose to carry out measures with your own resources or other providers. The plan and the score are equally valid whoever does the work. The review is the door in; the services are what we can do once we know what the organisation actually needs.
From findings to measures
What ORGSEC delivers
Every finding in the review has an answer. You do not need to deal with a service catalogue; you deal with what the review has shown.
- 01Competence programmesDigital programmes for employees and managers, adapted to roles and risk areas, with documented completion.
- 02TrainingSimulation for teams and key personnel, where situational awareness and decisions are practised in a safe setting.
- 03ExercisesDigital tabletop exercises for the leadership team, where the plans meet a scenario and weaknesses become visible before they have consequences.
- 04AnalysesRisk, preparedness and continuity analyses where the review shows that the basis is missing or outdated.
Findings and ORGSEC response
Examples of how findings in the review are met with concrete measures. The order and scope follow the plan from the previous step.
| Finding | ORGSEC response |
|---|---|
| Unclear role in total defence | Total defence analysis |
| Insufficient threat understanding | Threat assessment |
| Critical supplier dependencies | Business impact and supply-chain assessment |
| Weak continuity | Business continuity planning |
| Weak cyber governance | Cyber strategy and management system |
| NIS2 gap | Compliance assessment |
| Insider risk | Personnel security |
| Weak security culture | Security culture assessment |
| Poor crisis organisation | Crisis management and staff methodology |
| Untested plans | Tabletop or full-scale exercise |
| Insufficient leadership competence | Leadership development |
| Unclear physical exposure | Security risk analysis |
| No learning after incidents | Evaluation and investigation |
How resilience is built
- Culture: the values and norms that decide what actually gets done
- Training: together, repeated over time, so that those who must work together know each other
- Leadership: leaders who build trust in everyday work and can assess their own decisions under pressure
By us, or by whoever you choose
- Measures from ORGSEC are delivered digitally and documented
- Measures by your own resources or other providers count in the next review
- The plan and the score are equally valid whoever does the work
Resilience is built in everyday work. That is where the measures must work, not only in the documents.
