What Strategic Risk Advisory Means for Your Organisation

Most ERM teams record cyber as a single line owned by IT. Codec Networks breaks it into business scenarios, rates them on your enterprise scale, assigns business owners and links them to KRIs, so your existing ERM process can manage cyber like any other risk.

No. Listed companies have specific duties, but any organisation whose owners, lenders, insurers or customers ask about cyber oversight benefits. Codec Networks' Basic level suits mid-sized and family-owned businesses.

GRC builds and audits controls against standards such as ISO 27001. Strategic risk advisory helps leadership decide: which risks to accept, what they could cost, which deals to sign and how to respond in a crisis. Many clients use both, sharing one evidence base.

Yes. Codec Networks provides pre-investment due diligence for each deal and a repeatable checklist and dashboard for portfolio companies, so the fund sees cyber risk across holdings in one view.

Yes. Codec Networks reviews the use case, data, model risks, governance and privacy against ISO/IEC 42001 and the NIST AI RMF, sets go-live criteria and reports residual risk to your steering committee.

Yes. Tokenisation brings smart contract, custody and regulatory questions even for traditional businesses. Codec Networks reviews the model, the code, the keys and the governance before value is at stake.

Usually the chair or a nominated director, the CEO, CFO, General Counsel, CISO, CRO, communications head and key business leaders. Codec Networks agrees the participant list with the sponsor so the right decision-makers are in the room.

Yes. Codec Networks' incident response and forensics teams can support you, and the playbooks and decision rights built in war-games are the starting point for the response.

ISO 31000:2018 for the risk management framework and process, ISO/IEC 27005:2022 for information security risk, and NIST IR 8286 Rev. 1, published in December 2025, for linking cyber risk registers to enterprise risk management.

As general information: SEBI's LODR Regulation 21, as amended in May 2021, requires the top 1,000 listed entities by market capitalisation to have a risk management committee whose role specifically covers cyber security. Your company secretary should confirm how it applies to you.

FAIR (Factor Analysis of Information Risk) is a model for estimating the frequency and size of loss events, published by The Open Group as its Risk Taxonomy (O-RT) and Risk Analysis (O-RA) standards. It is widely used by risk teams and insurers.

India's AI Governance Guidelines, released by MeitY in November 2025, set principles for responsible AI under existing laws rather than a separate AI statute. The DPDP Act, sector rules and contracts still apply. Codec Networks maps these for your programme, for client information.

It can, if you place AI systems on the EU market or their output is used in the EU. Its prohibitions and general-purpose AI duties already apply, and the high-risk timelines were revised in 2026. Codec Networks checks applicability as part of the transformation review.

As general information: a March 2023 notification brought VDA service providers within the Prevention of Money-laundering Act, with registration and reporting to FIU-IND, and the Income-tax Act taxes VDA income and requires TDS on transfers. Codec Networks reviews these in Web3 audits; legal advice should confirm them.

As general information: RBI's Cyber Security Framework in Banks (RBI/2015-16/418, 2016) expects banks to have a cyber crisis management plan. Codec Networks' exercises test whether that plan works in practice.

If you are an SEC registrant, the SEC's 2023 rules require disclosure of material cyber incidents on Form 8-K within four business days and annual disclosure of risk management and governance. Codec Networks' Board reporting and exercises cover these decision points.

With a scoping call and a short interview with the sponsor, usually the CFO, CRO or company secretary. Codec Networks then agrees the scope, plan, participants and reporting cadence before work begins.

Very little: one interview for reporting needs, a briefing session and, for exercises, a half-day tabletop. Most work is done with management.

From your incident history, downtime records, financial data, insurance policies and security tools, supplemented by industry benchmarks and calibrated expert estimates where your own data is thin.

Deal work is handled under NDAs and Codec Networks' ISO/IEC 27001:2022 certified ISMS, with need-to-know access and clean-team arrangements where the transaction requires them.

Only with the target's consent and in agreed conditions. Without consent, Codec Networks relies on outside-in screening, document review and management interviews.

Tabletops and war-games use simulated injects and do not touch live systems. Technical ransomware simulations run only in agreed systems, with safeguards and written approval.

Scenarios are built from real incidents in your sector and from your own dependencies, such as critical vendors, plants or payment systems, with injects for regulators, media and customers.

Codec Networks debriefs participants, records decision gaps, updates the crisis plan and playbooks, and tracks actions to closure before the next exercise.

By the level you choose (Basic, Medium or Advanced) and by scope drivers such as entities, scenarios, deal size, programme phases, code size or exercise participants. Document 7 gives indicative bands; a written proposal confirms them after scoping.

An outside-in screen typically takes one to two weeks. A full due diligence typically takes three to six weeks, depending on data-room access and the deal timeline.

Per transaction, sized to the target and the depth required, from an outside-in screen to a full assessment with a 100-day plan.

Typically four to eight weeks for three to eight scenarios, depending on how quickly data can be gathered and calibrated.

Yes. Board reporting at the Advanced level is offered as a retainer that covers quarterly packs, briefings and updates.

Yes. The Board Risk Starter, Risk to Rupees and Board Resilience Programme bundles are priced below the sum of their parts because workshops, scenarios and data are reused.

No. Fees exclude GST, travel and third-party costs such as specialist tools or data. Proposals list them separately.

Codec Networks re-plans the phases with the deal team and confirms any change to effort or fee in writing before continuing.

A one-page view each quarter: top cyber risks against appetite, KRIs and trends, loss estimates where available, incidents, exercise findings and the decisions required.

As ranges of annual loss exposure for each top scenario, with the main assumptions and the effect of planned controls, so directors can compare options.

Yes. CRQ results show exposure against policy limits and retentions, and the evidence gathered helps answer underwriting questions.

Through quarterly updates under a retainer, triggered reviews after major incidents, deals or transformations, and an annual framework review.

Yes. Director briefings cover the threat landscape, the company's top cyber risks, oversight duties and their role during a crisis.

Approved risk appetite, quarterly packs, minutes of risk committee discussions, exercise reports and closure of actions together form a record of oversight.

Yes. Codec Networks tracks the 100-day plan, repeats the checklist periodically and keeps the fund's portfolio cyber dashboard current.

Most organisations run at least one Board tabletop a year and a multi-team war-game every one to two years, with extra exercises after major changes. Codec Networks plans this in an annual programme.