By seeing risk clearly, making proportionate decisions and building resilience that works in practice.
Seeing risk clearly. Building genuine resilience.
Cernis (Ker-nis) Advisory takes its name from the Latin word meaning "to see clearly" or "to distinguish". Every organisation has different needs, so we founded Cernis on the simple principle that leadership teams need clear insight into their cyber risk, free from technical jargon and noise.
With the increasing need for compliance and regulation required at basic levels, organisations need to prove a credible security and resilience posture, but rarely need, or can justify, a full-time CISO. We close that gap with adaptable, fractional risk leadership and vCISO strategy delivered directly to senior decision-makers. This can mean guiding you cleanly through a single standard, or as we have often seen, when no single standard fits, we take the right elements that matter and shape them into one clear, right-sized framework. Either way, we work with organisations of every size, from start-ups to large third-sector organisations. We work on your goals not ours, because earning real trust, the kind where a leadership team tells you what's actually wrong rather than what looks good, is where the real work begins.
Independent experience, translated into practical governance and proportionate decisions.
More than 20 years on the leadership team of a successful UK Managed Service Provider servicing over 300 clients, including 15 years as Security & Compliance Partner. Real operational credibility in every engagement.
Decades running IT infrastructure means we speak naturally with engineers, MSPs, and assessors. We then translate technical risk into plain business impact and board-level decisions.
We don't run day-to-day IT or resell software. Keeping technical execution separate from governance ensures our recommendations are not tied to a product sale.
Whether you need to work cleanly through a single ISO framework or Cyber Essentials, or need the best elements of several standards blended into one right-sized approach, we shape the path that actually fits and has the greatest impact.
To see clearly. To distinguish what matters. To act with confidence.
Reveal what matters most
We cut through complexity to build a clear, honest picture of your organisation's risk.
Separate signal from noise
We identify the priorities that matter and the areas where effort has the greatest impact.
Create confidence in direction
With a clear picture, we shape a practical, right-sized framework aligned to your goals.
Turn strategy into action
We work alongside your team to implement the plan and build lasting capability.
Sustainable results
Stronger governance, reduced risk, and genuine organisational resilience.
Clear advice. Proportionate protection. Practical resilience.
Tailored governance, compliance, and cyber risk solutions designed for enterprise assurance and operational clarity.
Establish decision rights, risk tolerance, and security policy frameworks aligned directly with organisational goals.
Identify, evaluate, and mitigate operational vulnerabilities across internal systems and vendor supply chains.
Streamline preparation for Cyber Essentials, IASME Cyber Assurance, ISO 27001, DSPT, AI Governance and client security audits.
Flexible, senior-level guidance to maintain your risk register, manage board reporting, and direct security strategy.
Get in touch to arrange an initial advisory conversation or request support for upcoming client assurance audits.
Funders, regulators and corporate partners increasingly expect charities to demonstrate a credible security and resilience posture; but few organisations need, or can justify, a full-time CISO. Cernis Advisory closes that gap: independent, plain-English governance, risk and cyber advisory. The level of governance, controls, assurance and certification should follow from the charity's actual risk profile, not the other way around.
Six connected capabilities. One proportionate approach.
Define accountability, risk appetite and the decisions your trustees need to make.
Identify what matters most, what could disrupt it, and where your greatest risks lie.
Choose the right level of assurance — from proportionate controls to formal certification where justified.
Provide ongoing senior cyber-risk oversight without the cost of a full-time CISO.
Give trustees clear, plain-English insight to make informed and defensible decisions.
Prepare for disruption, exercise your response and test whether you can recover when it matters.
Last updated: 19 October 2026
Cernis Advisory Limited ("Cernis Advisory", "we", "us", "our") is a cyber security, governance, risk and compliance (GRC) advisory firm registered in England and Wales (Company Registration No. 17447442, registered office: The Ferry Point, Ferry lane, Shepperton, England. TW17 9LQ, United Kingdom). Registered as a data controller with the Information Commissioner’s Office under registration number ZC252650.
This policy explains how we collect, use, store and protect personal data in connection with this website and our business relationships with clients, trusted partners and contacts.
The Directors are the data controllers and are responsible for the personal data described in this policy. We have appointed a data privacy manager who is responsible for overseeing our data protection. If you have any questions about this policy or your legal rights, please contact us at [email protected].
This website does not use cookies, analytics, or automated tracking, and does not run an on-site contact form. The only personal data we collect through the site is what you choose to send us directly by email — typically your name, email address, and the contents of your message.
As our site is hosted on Carrd, Carrd's own infrastructure may process limited technical data (such as IP address and browser type) as part of standard web hosting. This is governed by Carrd's own privacy policy, not this one.
During a client engagement, we may also collect business details (name, role, organisation, email, phone number) for the individuals we work with, as provided by you or your organisation. We may collect and store details of the services you purchase from us, and your preferences on receiving marketing and other communications.
To deliver our consultancy services, manage our business, and fulfill our legal obligations, we may share personal data with the following categories of third parties:
We do not sell personal data, nor do we share it with third parties for marketing purposes.
Our website may contain links to and from third-party websites including of our clients, partner networks, and affiliates. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and if you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these privacy policies or the data they may collect or share about you. When you leave our website, we encourage you to read the privacy policy of every website you visit.
We use secure, commercial third-party Artificial Intelligence and natural language processing platforms to assist us with administrative efficiency, such as summarizing meeting notes and drafting internal client reports.
In addition to the information you provide to us directly, we may also receive Personally Identifiable Information (PII) about you from external sources. We only collect this data when the third party has a lawful basis to share it with us.
This includes:
Where this happens, we handle that data under the same protections and legal bases described in this policy.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We will only use your personal data when the law allows us to. We rely on the following legal bases under UK GDPR:
Personal data we hold is stored within our Microsoft 365 environment (including Exchange Online, SharePoint, and OneDrive), with our tenant configured to the UK data region. Microsoft acts as our data processor under its own Data Protection Addendum and Product Terms. Access is restricted to authorised personnel and protected using multi-factor authentication and Microsoft 365's built-in encryption in transit and at rest.
Where any limited data transfer outside the UK occurs (for example, for Microsoft support purposes), this is covered by Microsoft's standard contractual safeguards.
Where we are engaged to deliver advisory services and are given access to a client's own data (for example, as part of a risk assessment or audit-readiness engagement), we process that data as a data processor under the terms of the relevant engagement letter or data processing agreement, not under this website privacy policy.
We do not carry out any automated decision-making or profiling on your personal data.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact our Data Protection Lead at [email protected]. We respond to all requests within one calendar month and do not charge a fee. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
This website is intended for business use and is not directed at children. We do not knowingly collect personal data from children.
We may update this policy when required. The date at the top of this page reflects the most recent revision. We therefore recommend that you check this page from time to time to take notice of any updates or changes. In relation to those changes and where we think it appropriate, we will take steps to inform you via appropriate means
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your details change during your relationship with us and let us know if the personal information that we hold about you needs to be corrected or updated.
Cernis Advisory Limited
The Ferry Point, Ferry lane, Shepperton, England. TW17 9LQ, United Kingdom
[email protected]
Five simple questions can reveal whether your organisation's risk, assurance and resilience are genuinely understood.
Can you connect your controls and investment to the services, information and risks that matter most?
Backups aren't the whole answer. Do you know your priorities, recovery expectations, owners — and whether they have been tested?
Your email, finance or case-management provider depends on others. Would you know about an outage, understand the impact and know what to do?
A plan is only the start. Clear authority, escalation, communications and rehearsed decisions determine whether it works.
Cyber Essentials and ISO 27001 can be valuable. The right route depends on your risks, obligations and the assurance actually needed.
Cernis helps you understand what really matters, choose a defensible level of protection and assurance, and turn that decision into a tested resilience plan.
Discuss your resilience →Cyber resilience isn't just about technology. These questions explore ownership, assurance, suppliers and whether your plans work in practice.
Cyber risk can be delegated for management, but leadership still needs clear ownership, visibility and informed oversight.
Your IT provider may operate the controls. Leadership still needs a way to understand whether those controls address the organisation's actual risks.
Technology dependencies become business risks when essential services cannot continue. Do your recovery priorities reflect that reality?
A plan can look convincing on paper. A tabletop or recovery exercise reveals assumptions, unclear responsibilities and gaps before an incident does.
Confidence is stronger when it is supported by evidence: understood risks, clear decisions, proportionate controls and tested response arrangements.
You don't need perfect answers to every question. But you should understand where the uncertainty lies, what matters most and what needs to happen next. That's where Cernis can help.
Discuss your resilience →