Capstone Cyber — Fractional CISO, GRC Advisory & AI Governance

Q: What is a fractional CISO?

A fractional CISO (Chief Information Security Officer) is a senior security professional who works with an organisation on a part-time or project basis rather than as a full-time employee. This gives mid-market and regulated firms access to board-level security expertise — including governance, regulatory compliance, and incident response — without the overhead of a full-time hire.

Q: What is the AGMA methodology?

AGMA (AI Governance Maturity Assessment) is a proprietary framework developed by Capstone Cyber. It comprises 66 controls across eight domains, scored on a CMMI 1–5 maturity scale. It maps to ISO 42001, NIST AI RMF, EU AI Act, NCSC guidelines, and the OWASP LLM Top 10, providing a structured, evidence-based view of an organisation's AI governance posture.

Q: What regulations does Capstone Cyber cover?

Capstone Cyber advises on ISO 27001, ISO 42001, DORA (Digital Operational Resilience Act), FCA operational resilience requirements, EU AI Act, GDPR, NCSC Cyber Assessment Framework (CAF 4.0), SWIFT CSP, Cyber Essentials and Cyber Essentials Plus, Consumer Duty, SM&CR, and the Data (Use and Access) Act 2025.

Q: Does Capstone Cyber require a retainer?

No. Capstone Cyber does not require a retainer to begin a conversation or initial assessment. Engagements are structured around specific deliverables and outcomes, making them IR35-safe and accessible to organisations that need targeted expertise without long-term contractual commitment.

Q: Which sectors does Capstone Cyber serve?

Capstone Cyber specialises in regulated sectors including financial services (banks, asset managers, fintechs, payment firms), healthcare, and professional services. These are environments where security, compliance, and resilience carry regulatory weight and board-level accountability.

Capstone Cyber

Insight Article | Capstone Cyber

Insight Article on Capstone Cyber. An authoritative, editorial-driven consultancy platform for senior security lead.