Frequently Asked Questions

KairosVector provides cybersecurity consulting focused on IT, operational technology, AI governance, risk, and regulatory requirements. The scope of each engagement is tailored to the organisation’s environment and objectives.

We work with organisations that need support with cybersecurity, operational technology, AI risk, compliance, or resilience. The engagement can be scoped around a specific assessment, regulatory requirement, security programme, or broader transformation.

Engagements generally begin by understanding the organisation’s environment, objectives, and constraints. The scope, deliverables, timeline, and responsibilities are then defined before the assessment or implementation work begins.

An assessment can review identity and access controls, network architecture, endpoint security, vulnerability management, logging, incident readiness, and security governance. The exact scope depends on the organisation’s environment and risk priorities.

Cloud security reviews can cover identity and access management, network controls, data protection, logging, configuration, workload security, and the connections between cloud and on-premises environments.

Zero Trust is a security approach that does not automatically trust users, devices, or network locations. Access is evaluated using factors such as identity, device state, context, and policy rather than relying solely on network location.

OT security protects systems that monitor or control physical processes. Unlike many IT environments, OT must account for safety, availability, legacy equipment, operational continuity, and the potential physical consequences of a security event.

Connections between enterprise IT and industrial environments can create additional paths for threats to reach OT systems. Security controls therefore need to account for both the business network and the operational environment.

Security work in OT environments should account for production schedules, safety requirements, system dependencies, and maintenance windows. Assessments and remediation should therefore be planned around operational constraints rather than applying IT controls without modification.

IEC 62443 is a family of standards focused on cybersecurity for industrial automation and control systems. It provides a structured approach to security across system design, components, processes, and the lifecycle of industrial environments.

AI governance defines how an organisation evaluates, deploys, monitors, and manages AI systems. It can cover security, data handling, accountability, human oversight, risk management, and regulatory requirements.

Using third-party AI still creates questions around data, vendor risk, access, acceptable use, security, and accountability. A governance framework helps define which tools and use cases are permitted and what controls are required.

Yes. Depending on the system, an assessment can examine prompt injection, unauthorized data exposure, access controls, model and application dependencies, output handling, and other security risks relevant to the AI implementation.

The EU Cyber Resilience Act establishes cybersecurity requirements for products with digital elements placed on the EU market. organisations may need to address security throughout product design, development, maintenance, vulnerability handling, and the product lifecycle.

NIS2 is an EU cybersecurity directive that expands and strengthens cybersecurity requirements for organisations in covered sectors. Its requirements include risk management, incident handling, governance, and supply-chain security, subject to the applicable national implementation.

ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an information security management system. organisations use it to manage information security risks through a structured management system.

Compliance readiness can include gap assessment, control mapping, evidence preparation, remediation planning, and support for implementation. The exact scope depends on the applicable regulation, standard, and organisation.

A typical assessment considers the organisation’s business context, assets, threats, existing controls, vulnerabilities, and potential impact. The findings can then be prioritised into practical remediation actions based on risk and business requirements.

Technical findings are translated into business impact, priorities, dependencies, and remediation options. This helps leadership understand which risks require immediate attention and where security investment can have the greatest effect.

Yes, where it is relevant to the engagement. A supply-chain review can consider vendor access, security requirements, data handling, dependencies, incident processes, and the risks associated with critical third parties.

Follow the organisation’s incident response plan, preserve relevant evidence, contain affected systems where appropriate, and involve the designated incident response and leadership teams. Actions should be coordinated carefully to avoid destroying evidence or disrupting critical operations unnecessarily.

Incident response planning can include roles and responsibilities, escalation paths, communication procedures, evidence handling, recovery considerations, and scenario-based exercises. The plan should reflect the organisation’s technology, operations, and regulatory obligations.

Preparation can include backup and recovery reviews, incident response planning, access-control improvements, network segmentation, tabletop exercises, and recovery testing. The objective is to reduce both the likelihood and operational impact of a ransomware event.

Yes. A focused assessment can be a practical starting point when an organisation wants to understand a specific risk or requirement before expanding the scope. The initial scope can be defined around a system, site, regulation, or business priority.

There is no single timeline. Duration depends on the scope, number of systems or sites, availability of information, and the depth of assessment required. A focused review may be completed faster than a multi-site or enterprise-wide assessment.

You can contact KairosVector with an overview of your environment, security challenge, regulatory requirement, or project objective. The initial discussion can be used to determine whether a focused assessment or broader engagement is appropriate.