MSXCyber® — information security
ISMS support aligned to ISO 27001, with governance, risk management and audit-ready evidence for cybersecurity programmes — complementing the identity and backup controls in our cybersecurity practice.
An Information Security Management System, in the ISO 27001 sense, is not antivirus software or a firewall policy; it's the ongoing set of processes, risk assessments, controls and management reviews an organisation runs to protect information assets, and it's what an ISO 27001 certification audit actually assesses. MSXCyber gives you that ISMS structure: risk identification and treatment, control tracking, incident logging and the audit-ready evidence trail a certification body or client due-diligence review expects to see, rather than a checklist maintained in a document that nobody updates between audits.
It's built to complement, not duplicate, the technical controls already in place. Where our cybersecurity practice handles identity management, access control and backup resilience at the infrastructure layer, MSXCyber sits above that as the governance layer, evidencing that those technical controls are risk-assessed, monitored and reviewed in line with ISO 27001, which is usually the gap that shows up first when a client or lender asks for proof rather than assurance.
We implement XGRC®, the 4Sight alliance's governance platform from Strategix — a single, auditable foundation that unifies governance, risk, compliance, cybersecurity, safety and ESG instead of managing each in a separate spreadsheet or system. Adopt the module that solves your most pressing problem today, then combine more over time on the same platform, without migrating data or rebuilding processes.
MSX® — management system hub
A flexible, integrated hub that unifies multiple XGRC disciplines into one coordinated management system, instead of separate tools that don't talk to each other.
SHEQX® — safety & quality
Management of safety, health, environment and quality risks, incidents, audits and actions, aligned to ISO 9001, ISO 14001 and ISO 45001.
Enterprise risk & integrated assurance
A structured, auditable approach to enterprise, operational and project risk aligned to ISO 31000 and COSO, with internal audit and combined assurance linked directly to risks, controls and actions.
How is this different from tracking risk and compliance in spreadsheets?
A spreadsheet answers one question at a time and has no audit trail. XGRC keeps risks, controls, obligations and evidence linked to each other on one platform, so an auditor sees a live, defensible record instead of a reconstruction exercise — and a control failure in one area shows up against the risks and obligations it actually affects.
Do we need all the modules, or can we start with one?
Start with whichever problem is most pressing — often cybersecurity governance (MSXCyber) or safety and quality (SHEQX) — and add modules later on the same platform without migrating data or rebuilding processes. That staged approach is how the platform is designed to be adopted.
Which frameworks and standards does this map to?
ISO 27001 for information security, ISO 9001 for quality, ISO 14001 for environmental management, ISO 45001 for health and safety, and ISO 31000 with COSO for enterprise risk. Which of these actually bind you depends on your sector, lenders and customers — the same assessment work we do for ESG reporting applies here.
What is MAIA and is it safe to use with sensitive governance data?
MAIA is governed AI embedded within XGRC, built so decision-makers can ask questions of risk registers, policies and audit records and get instant answers — through controlled, audited AI integrations with a complete interaction audit trail. Every query and answer is logged, which is the point: it's an audited channel into your governance data, not an open AI tool pointed at it.
Platforms: XGRC · MSX · MSXCyber · SHEQX