Matthew Carr

CISO-as-a-Service

I give growing and operationally critical businesses the cybersecurity leadership of a CISO — without the cost and commitment of a full-time executive hire.

£4,950a month

What the retainer covers.

Eight commitments on a schedule you can hold me to. Nothing appears here that I would be uncomfortable having read out in your board meeting.

Direct access to your named CISO

I appear on your org chart and in your executive meetings. When a customer asks who runs security at your company, there is a name to give them, and I will take the call.

Cyber-risk strategy and roadmap

A twelve-month plan covering what gets fixed, in what order, by whom, and what each item costs. We review it at every quarter mark and change it when the facts change.

Risk-register ownership

I keep the register myself: the scoring, the updates and the movement between quarters. It stays current, so when a customer or an auditor asks to see it there is nothing to prepare.

Monthly executive reporting

An hour a month with your leadership team. I bring the decisions that need making and the trade-offs behind them, and we work through them in the room.

Quarterly board briefings

Four written briefings a year, in the language your board already uses: where you stand, what has moved since the last one, and what needs a decision from them.

Supplier and technology oversight

I review the suppliers, platforms and integrators your operation depends on. When a customer turns that same scrutiny on you, I sit on your side of the table.

Incident preparedness

A written plan with named roles and a decision tree for the first hour, covering who calls the regulator, who calls the insurer and who calls the customer. Then we walk through it before you need it.

Guidance through scrutiny

Audits, customer security reviews and insurance renewals. I translate what is being asked into what you should do about it, and I answer the technical questions so your team can get on with their work.

What a year looks like.

Security leadership fails when it only happens after something has gone wrong. The value of a retainer is the rhythm.

Executive reporting

An hour with your leadership team.

Board briefing

A written pack, four times a year.

Strategy and roadmap

Set at the start, reviewed each quarter.

Direct access

Between the sessions, within reason.

The onboarding assessment runs before month one. It produces the risk register and the roadmap that the rest of the year works against.

What the retainer does not cover.

These are real pieces of work with real costs. Keeping them outside the retainer is what holds the monthly fee at £4,950. Ask for any of them and you get a scoped quote.

Penetration testing

Quoted separately

Testing has its own scope, its own tooling and its own report. I run and oversee it as a separate engagement. Fifteen years of doing this work means you are not being handed to a stranger.

24/7 incident response

Quoted separately

A standby rota has to be staffed around the clock. That cost cannot sit inside a monthly retainer. I plan for the incident and arrange the rota separately.

Implementation

Quoted separately

Building, configuring and running controls is hands-on delivery work. I set the direction and oversee it while Atumcell's specialists do the building.

Extensive policy writing

Quoted separately

Reviewing and maintaining the policy set you already have is included. Writing a full set from nothing is a project with its own timeline.

Unlimited security questionnaires

Quoted separately

Reasonable support is included. If questionnaires start arriving weekly, that needs its own arrangement rather than eating the retainer.

£4,950a month

The retainer. Everything in the scope above, on the cadence above, with direct access to me between the sessions.

£5,000one-off

The onboarding assessment. It establishes where you actually stand and produces the register and roadmap the retainer runs on.

Waived on a twelve-month commitment.

No day rates, no per-seat pricing, and no line items you did not agree to. Prices exclude VAT.

Questions people ask first.

What does “named” actually mean?

One person. I appear on your org chart, I attend your executive meetings, and I am the name your customers and your board see against security. When a piece of work needs hands, Atumcell's specialists pick it up behind me, and I stay accountable for what they produce.

How much of your time do we get?

A fixed cadence: an hour of executive reporting each month and a written board briefing each quarter, plus direct access to me between them. You are buying an accountable owner and a seat at your table. If you need somebody in the building five days a week, hire an employee and I will help you write the job description.

Who owns the risk register?

I do. I score it, I keep it current, and I bring the movement to your board. Your team stays accountable for the individual risks recorded in it, which is where that accountability belongs.

We need a penetration test and 24/7 cover. Can you arrange them?

Yes, and both are scoped and quoted separately. I have spent most of my career on the offensive side, so I will tell you what a test is worth before you buy one. Keeping delivery work outside the retainer is what holds the monthly fee at £4,950.

Do you write our policies?

The retainer covers review and oversight of the policy set you have. Writing a full set from nothing is a separate project, and I would rather quote it honestly than pretend it fits in a retainer.

Can we skip the onboarding assessment?

No. The assessment produces the risk register and the roadmap that the retainer then runs on. Without it I would be guessing for the first three months and charging you for the privilege. Commit to twelve months and the fee is waived.

Is this only for industrial companies?

No. It suits any growing company that has outgrown ad-hoc security. It suits operationally critical organisations especially well, because plants, utilities and transport networks are where I have spent fifteen years.

Find out what a named CISO would change.

Thirty minutes, confidential, directly with me. We look at what you are being asked for, what you already have, and whether this is the right shape for you.

£4,950 per month. £5,000 onboarding assessment, waived on a twelve-month commitment.