Pragmatic Cyber Risk & Governance Advisory
Helping organisations understand what really matters, choose a defensible level of protection and assurance, and turn that decision into a tested resilience plan.
Targeted Governance
- Board and Senior Leadership advisory
- Proportional, risk-based security controls
- Guided Tabletop Exercises
- Cyber Essentials & IASME Assurance alignment
- Fractional GRC oversight
Why Cernis
Seeing risk clearly. Building genuine resilience.
Cernis (Ker-nis) Advisory takes its name from the Latin word meaning "to see clearly" or "to distinguish". Every organisation has different needs, so we founded Cernis on the simple principle that leadership teams need clear insight into their cyber risk, free from technical jargon and noise.
With the increasing need for compliance and regulation required at basic levels, organisations need to prove a credible security and resilience posture, but rarely need, or can justify, a full-time CISO. We close that gap with adaptable, fractional risk leadership and vCISO strategy delivered directly to senior decision-makers. This can mean guiding you cleanly through a single standard, or as we have often seen, when no single standard fits, we take the right elements that matter and shape them into one clear, right-sized framework. Either way, we work with organisations of every size, from start-ups to large third-sector organisations. We work on your goals not ours, because earning real trust, the kind where a leadership team tells you what's actually wrong rather than what looks good, is where the real work begins.
Real-World IT Leadership
More than 25 years on the leadership team of a successful UK Managed Service Provider servicing over 300 clients, including 15 years as Security & Compliance Partner. Real operational credibility in every engagement.
Wired for the Boardroom
Decades running IT infrastructure means we speak naturally with engineers, MSPs, and assessors. We then translate technical risk into plain business impact and board-level decisions.
Hands-Off, By Design
We don't run day-to-day IT or resell software. Keeping technical execution separate from governance ensures our recommendations are not tied to a product sale.
Your Framework, Right-Sized
Whether you need to work cleanly through a single ISO framework or Cyber Essentials, or need the best elements of several standards blended into one right-sized approach, we shape the path that actually fits and has the greatest impact.
Matthew Armsby
Founder
With more than 25 years on the leadership team of a successful UK Managed Service Provider, including 15 years as Security & Compliance Partner, Matthew brings technical expertise and deep operational knowledge to board-level risk management. A former NCSC Assured Cyber Advisor, he has spent decades assessing technical controls, managing supply-chain risk, and guiding organisations through complex compliance frameworks, building resilience at every level. He also brings first-hand board experience, having served as a charity trustee for six years, including as Chair of Trustees. He founded Cernis Advisory to give growing businesses and third-sector boards independent, plain-English CISO oversight, without the full-time executive overhead. Matthew takes the time to properly understand each organisation before recommending anything, researching thoroughly, listening closely, and pitching every conversation at the right level for whoever's in the room, from technical teams to the boardroom.
Our Approach
To see clearly. To distinguish what matters. To act with confidence.
See Clearly
Reveal what matters most
We cut through complexity to build a clear, honest picture of your organisation's risk.
Distinguish
Separate signal from noise
We identify the priorities that matter and the areas where effort has the greatest impact.
Decide
Create confidence in direction
With a clear picture, we shape a practical, right-sized framework aligned to your goals.
Deliver
Turn strategy into action
We work alongside your team to implement the plan and build lasting capability.
Realise Value
Sustainable results
Stronger governance, reduced risk, and genuine organisational resilience.
Core Advisory Services
Tailored governance, compliance, and cyber risk solutions designed for enterprise assurance and operational clarity.
Governance & Strategy
Establish decision rights, risk tolerance, and security policy frameworks aligned directly with organisational goals.
Cyber Risk Management
Identify, evaluate, and mitigate operational vulnerabilities across internal systems and vendor supply chains.
Compliance Readiness
Streamline preparation for Cyber Essentials, IASME Cyber Assurance, ISO 27001, DSPT, AI Governance and client security audits.
Fractional Leadership
Flexible, senior-level guidance to maintain your risk register, manage board reporting, and direct security strategy.
Discuss Your Governance & Cyber Risk Requirements
Get in touch to arrange an initial advisory conversation or request support for upcoming client assurance audits.
[email protected]
Governance, Risk & Cyber Resilience for the Third Sector
Funders, regulators and corporate partners increasingly expect charities to demonstrate a credible security and resilience posture; but few organisations need, or can justify, a full-time CISO. Cernis Advisory closes that gap: independent, plain-English governance, risk and cyber advisory. The level of governance, controls, assurance and certification should follow from the charity's actual risk profile, not the other way around.
From understanding risk to building resilience
Six connected capabilities. One proportionate approach.
Governance & Strategy
Define accountability, risk appetite and the decisions your trustees need to make.
Cyber Risk Management
Identify what matters most, what could disrupt it, and where your greatest risks lie.
Compliance Readiness
Choose the right level of assurance — from proportionate controls to formal certification where justified.
Fractional Leadership
Provide ongoing senior cyber-risk oversight without the cost of a full-time CISO.
Trustee & Board Briefings
Give trustees clear, plain-English insight to make informed and defensible decisions.
Incident Response & Resilience
Prepare for disruption, exercise your response and test whether you can recover when it matters.
Why Cernis for the Third Sector
- Independent, by design — we don't run day-to-day IT or resell software, so our recommendations aren't tied to a product sale.
- First-hand board experience — six years as a charity trustee, including as Chair of Trustees.
- Plain-English delivery — built for trustee confidence, not just paperwork or a certificate.
- Right-sized, not off-the-shelf — solutions drawn from recognised frameworks and shaped around your organisation's actual risk and budget.
Privacy Policy
Last updated: 18 September 2026
Cernis Advisory Limited ("Cernis Advisory", "we", "us", "our") is a cyber security, governance, risk and compliance (GRC) advisory firm registered in England and Wales (Company Registration No. 17447442, registered office: The Ferry Point, Ferry lane, Shepperton, England. TW17 9LQ, United Kingdom). Registered with the Information Commissioner’s Office number ZC252650.
This policy explains how we collect, use, store and protect personal data in connection with this website and our business relationships with clients, trusted partners and contacts.
The Directors are the data controllers for the personal data described in this policy. If you have any questions, contact us our Data Protection Lead [email protected].
What data we collect
This website does not use cookies, analytics, or automated tracking, and does not run an on-site contact form. The only personal data we collect through the site is what you choose to send us directly by email — typically your name, email address, and the contents of your message.
As our site is hosted on Carrd, Carrd's own infrastructure may process limited technical data (such as IP address and browser type) as part of standard web hosting. This is governed by Carrd's own privacy policy, not this one.
During a client engagement, we may also collect business details (name, role, organisation, email, phone number) for the individuals we work with, as provided by you or your organisation. We may collect and store details of the services you purchase from us, and your preferences on receiving marketing and other communications.
Third Parties we share data with
To deliver our consultancy services, manage our business, and fulfill our legal obligations, we may share personal data with the following categories of third parties:
- Professional Subcontractors & Associate Consultants: Independent specialists or associate consultants assisting with project delivery under strict non-disclosure and data protection terms.
- Financial & Payment Processors: Banking and invoicing platforms used to manage accounts and log financial transactions.
- IT, Cloud, & Software Providers: Secure UK-hosted cloud environments (such as Microsoft 365) and essential operational platform providers operating under recognized UK GDPR transfer safeguards.
- Professional Advisers: External accountants, legal counsel, and insurers to manage corporate governance and risk.
We do not sell personal data, nor do we share it with third parties for marketing purposes.
Use of Artificial Intelligence (AI) and Automation Tools
We use secure, commercial third-party Artificial Intelligence and natural language processing platforms to assist us with administrative efficiency, such as summarizing meeting notes and drafting internal client reports.
- Data Minimisation: The data processed by these tools is strictly limited to basic professional identification markers, specifically names and job roles. We do not submit sensitive personal data or full unedited transcripts into these systems.
- Data Safeguards: We only utilise commercial enterprise tiers of these tools. We ensure that contractual agreements (Data Processing Addendums) are in place preventing the AI providers from using our client data to train their models, and ensuring data is handled confidentially and securely.
Third Parties we receive data from
In addition to the information you provide to us directly, we may also receive Personally Identifiable Information (PII) about you from external sources. We only collect this data when the third party has a lawful basis to share it with us.
This includes:
- Clients & Employers: When a client engages us for consultancy services, they may provide us with data about their employees, stakeholders, or suppliers to allow us to deliver project work, training, or assessments.
- Credit Reference & Fraud Prevention Agencies: We may receive financial or background checks regarding new corporate clients or vendors to assess credit risk
- Recruitment Agencies & Background Check Providers: For current or prospective employees, we receive data such as CVs, employment histories, and reference checks from professional recruiters or vetting agencies.
- Publicly Available Sources: We may collect professional contact details from platforms like LinkedIn or Companies House for business development and verification purposes.
Where this happens, we handle that data under the same protections and legal bases described in this policy.
How we use your data
- To respond to enquiries and discuss potential engagements
- To deliver advisory services under a signed engagement or contract
- To manage our ongoing business relationship with clients and contacts
- To meet our legal, accounting, and regulatory obligations
Legal basis for processing
We rely on the following legal bases under UK GDPR:
- Legitimate interests — responding to enquiries and maintaining business relationships with contacts and prospective clients
- Contract — where processing is necessary to perform an engagement you or your organisation has entered into with us
- Legal obligation — where we are required to retain records for accounting, tax, or regulatory purposes
Where your data is stored
Personal data we hold is stored within our Microsoft 365 environment (including Exchange Online, SharePoint, and OneDrive), with our tenant configured to the UK data region. Microsoft acts as our data processor under its own Data Protection Addendum and Product Terms. Access is restricted to authorised personnel and protected using multi-factor authentication and Microsoft 365's built-in encryption in transit and at rest.
Where any limited data transfer outside the UK occurs (for example, for Microsoft support purposes), this is covered by Microsoft's standard contractual safeguards.
Data we process on behalf of clients
Where we are engaged to deliver advisory services and are given access to a client's own data (for example, as part of a risk assessment or audit-readiness engagement), we process that data as a data processor under the terms of the relevant engagement letter or data processing agreement, not under this website privacy policy.
How long we keep your data
- General enquiries that do not proceed to an engagement: retained for up to 24 months, then deleted
- Client and engagement records: retained for 6 years from the end of the engagement, in line with standard UK record-keeping practice for accounting and professional liability purposes
Automated Decision-Making
We do not carry out any automated decision-making or profiling on your personal data.
Your rights
Under UK GDPR, you have the right to:
- Request access to the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data, where applicable
- Object to or request restriction of processing
- Request a copy of your data in a portable format
- Withdraw consent, where processing relies on consent
To exercise any of these rights, contact our Data Protection Lead at [email protected]. We respond to all requests within one calendar month and do not charge a fee. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Third parties we use
- Microsoft Corporation: Primary business tools and storage (Microsoft 365 email, SharePoint, OneDrive), hosted within the UK Data Region.
- Carrd Inc.: Website hosting infrastructure located in the United States. Data transfers are safeguarded via the UK International Data Transfer Agreement (IDTA) / UK Addendum to EU SCCs.
We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
Children's data
This website is intended for business use and is not directed at children. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects the most recent revision.
Contact us
Cernis Advisory Limited
The Ferry Point, Ferry lane, Shepperton, England. TW17 9LQ, United Kingdom
[email protected]
How confident are you in your cyber resilience?
Five simple questions can reveal whether your organisation's risk, assurance and resilience are genuinely understood.
Can you connect your controls and investment to the services, information and risks that matter most?
Backups aren't the whole answer. Do you know your priorities, recovery expectations, owners — and whether they have been tested?
Your email, finance or case-management provider depends on others. Would you know about an outage, understand the impact and know what to do?
A plan is only the start. Clear authority, escalation, communications and rehearsed decisions determine whether it works.
Cyber Essentials and ISO 27001 can be valuable. The right route depends on your risks, obligations and the assurance actually needed.
Not completely confident in your answers?
Cernis helps you understand what really matters, choose a defensible level of protection and assurance, and turn that decision into a tested resilience plan.
Discuss your resilience →Look a little deeper
Cyber resilience isn't just about technology. These questions explore ownership, assurance, suppliers and whether your plans work in practice.
Cyber risk can be delegated for management, but leadership still needs clear ownership, visibility and informed oversight.
Your IT provider may operate the controls. Leadership still needs a way to understand whether those controls address the organisation's actual risks.
Technology dependencies become business risks when essential services cannot continue. Do your recovery priorities reflect that reality?
A plan can look convincing on paper. A tabletop or recovery exercise reveals assumptions, unclear responsibilities and gaps before an incident does.
Confidence is stronger when it is supported by evidence: understood risks, clear decisions, proportionate controls and tested response arrangements.
How confident are you in the answers?
You don't need perfect answers to every question. But you should understand where the uncertainty lies, what matters most and what needs to happen next. That's where Cernis can help.
Discuss your resilience →