Article

Cyber Security Consultancy: People

October 19, 2025

Introduction

The workforce is trusted. Roles are defined, systems are secure, and business is thriving. Everything feels under control – that is, until the incident happens…

A senior employee, with privileged access, has a serious grudge. One day, they take action. Sensitive payroll data, including names, bank details, and salaries, was leaked online. Headlines follow. Legal action starts. Reputational damage is taking place right in front of your eyes. People are always going to be your greatest asset. But there are also risks to consider.

This introduction is based on a real-life story of an insider threat, where nearly 100,000 employees had their personal data exposed. In this article, we focus on the theme of people, referencing a case study and providing general guidance and recommendations.

What is meant by People?

People relate to the support provided for staff (including contractors) and the associated culture. It relates to the understanding of risk, following policies, and handling of data. It includes training and managing insider threats. Empowering people to reduce human error and strengthen an organisation’s cyber resilience.

Example Case Study

- Organisation: WM Morrisons Supermarkets Plc
- Incident: A senior internal auditor, disgruntled after disciplinary action, deliberately leaked payroll data of nearly 100,000 employees, including names, bank details, salaries, and national insurance numbers. The data was posted online and sent to media outlets.
- Financial Implications: The breach is reported to have cost Morrisons over £2 million to rectify.
- How it Links to the theme of People:
  - Insider threat – the importance of vetting, monitoring, and behavioural awareness
  - Staff awareness and training – the importance of educating staff on data handling and reporting concerns
  - Access control – the case study demonstrates the risks of access to sensitive data
Source Information: https://www.bbc.co.uk/news/uk-england-42193502?link_location=live-reporting-story

General Guidance

Staff awareness is key
Manage insider risks
Ensure onboarding and offboarding processes protect sensitive data
Ensure awareness training includes contractors

Resulting Recommendations

Keep it simple and secure
Use a risk assessment and your risk appetite to help drive the requirements for your organisation
Deliver regular cyber awareness training
Include contractors in training exercises and document attendance
Limit access rights based on job responsibilities and monitor for misuse
Implement starters, leavers and movers procedures
Seek guidance and support from an IASME Certification Body and Certified Information System Security Professional (CISSP) – such as RB Consultancy Ltd

How We Help

At RB Consultancy Ltd, we support organisations by:

Providing templates, guidance and experience to support
Explaining what security measures are available and how they can help
Collaborating to implement controls to support the requirements
Assessing and issuing certifications – such as Cyber Essentials and Cyber Assurance
Contact us for consultancy and certification support

Conclusion

People are at the heart of every organisation. Employees are vital to organisational success; however, they can present a risk. The Morrisons case study shows how a single insider threat can lead to catastrophic events and reputational damage. Embedding cyber security into everyday operations can build trust and reduce weaknesses.

RB Consultancy Ltd helps organisations understand the importance of people – we support the implementation of key requirements and help build cyber resilience. We are an IASME Certification Body and NCSC Assured Service Provider who provides services to empower and protect organisations. Holding CISSP and ISO 27001 lead implementer certification, you can Contact Us for assistance with cyber security resilience.

This blog is written by Remo Belisari, Managing Director of RB Consultancy Ltd. He is an experienced cyber security professional and cyber advisor. Remo holds certifications in CISSP, ISSAP, ISO 27001, Cyber Essentials, and IASME Cyber Assurance. He has many years of experience in IT and cybersecurity. He has supported organisations worldwide. His work includes helping a Fortune 500 company in the USA and over 100 organisations across the UK. The views in this blog are his own. They do not necessarily reflect the views of RB Consultancy Ltd, its clients, partners, or affiliates. The content is for general information only.

Why I signed The Cyber Resilience Pledge and why it matters

July 16, 2026 No Comments

The Cyber Resilience Pledge is an initiative developed by DSIT and NCSC that asks organisations to commit to treating cyber risk as a business risk

Cyber Security Consultancy: Incident Response

June 26, 2026 No Comments

Incident response planning is the difference between a contained breach and a business-ending disaster. Using the 2014 Sony Pictures attack as a case study, we explain what incident response is, why it matters, and how to strengthen cyber resilience.

Cyber Security Consultancy: Change Management

March 25, 2026 No Comments

Cyber Security Consultancy: Change Management A single change can bring multiple organisations to a standstill – the July 2024 CrowdStrike incident proved this, causing widespread outages across airlines, hospitals, and banks without any threat actors involved. Effective IT change management and business continuity planning require thorough testing, risk assessment, and rollback procedures before changes go […]

Cyber Security Consultancy: Physical and Environmental Protection

March 19, 2026 No Comments

Cyber Security Consultancy: Physical and Environmental Protection Cyber resilience goes beyond firewalls and passwords, physical security controls and environmental risk management are equally critical to protecting your organisation. Storm Dennis showed how flooding can destroy server rooms, backups, and operations in hours, highlighting why business continuity planning must account for real-world threats like fire, flood, […]

Cyber Security Risk Management: Supply Chain Security & Building Resilience

February 4, 2026 No Comments

Cyber Security Risk Management: Protecting Against Supply Chain Security Risks Effective cyber security risk management is not about eliminating every threat – it’s about understanding what could go wrong and putting appropriate measures in place to protect what matters most. The 2020 SolarWinds attack exposed critical supply chain security risks, with thousands of organisations compromised […]

Cyber Security Consultancy: Policy and Data Protection

October 21, 2025 No Comments

Introduction The team confirms that information security policies are good. Wireless networks are secure, endpoints are protected, and access rights are documented. But then it happens… Fraudulent activity is identified across customer accounts. Then the calls come. Many customers are impacted. Forensics teams are involved. A data breach is traced to an insecure wireless access […]

Get started today

Ready to get certified and
reduce your cyber risk?

Book a free 30-minute discovery call with Remo. No sales pitch, no pressure — just a straightforward conversation about what you need and whether we are the right fit to help.

About RB Consultancy Ltd

Remo Belisari

Founder & Managing Director, RB Consultancy Ltd

Remo Belisari is a Chartered Cyber Security Professional with over a decade of experience advising organisations from start-ups to multinationals across the UK, Europe, Asia and the USA.

Through RB Consultancy Ltd he delivers high-quality, cost-effective and practical cyber security services that support compliance, strengthen resilience and enable business growth.

Remo holds the most respected certifications in the field and is personally involved in every client engagement, ensuring clear and valuable outcomes.