SAFE Cyber Strategic Framework

What is SAFE?

SAFE helps measure cyber maturity, identify business-critical gaps, and build a practical security roadmap

It allows business leaders to fully understand their current security posture, prioritise investment, reduce operational risk, and strengthen resilience over time.

Built for CISOs, IT Directors, and boards, SAFE turns cyber security into a clear business conversation about risk, continuity, governance, and planned improvement. It stands for Strategy, Assessment, Frameworks and Execution.

SAFE explained

SAFE is ITHQ's cyber resilience framework for assessing your organisation's security posture, where the real risk sits and what should happen next.

SAFE gives leaders a clear view of cyber maturity and a reliable basis for prioritised decision making.

This is not a one-off review, report or health check. SAFE creates an ongoing cycle of assessment, prioritisation, improvement, and reassessment. That means stronger visibility, better governance, and a more resilient organisation over time that moves with the changing nature of the attack surface.

TLDR: SAFE helps you understand your true cyber position, decide what matters most, and improve it with purpose. Not a one-off review, this ongoing cycle of assessment, insight, and improvement delivers:

A clear view of current cyber resilience and security posture in the context of a continuously evolving threat landscape
Prioritised roadmap based on business risk and impact
Regular assessment to track progress and adapt to change
Stronger board reporting, governance and investment planning
Ongoing partnership with ITHQ to improve resilience over time

Skip to process

Download SAFE intro pack

Why SAFE matters

SAFE matters because cyber resilience matters, and the attack surface keeps expanding

Cyber security is no longer just a technical concern. It affects operational continuity, leadership confidence, regulatory readiness, insurer scrutiny, supplier trust, and the organisation’s ability to grow safely.

Many businesses have controls in place, but fewer have a clear, evidence-based view of how resilient they really are.

SAFE helps organisations move from fragmented security activity and unclear priorities to a more structured, measurable, and defensible cyber resilience strategy.

Proven reported results from clients include:

Clearer visibility of cyber and resilience gaps
Sharper prioritisation of security investment
Sound evidence for board, insurer, and audit conversations
Confident planning around operational resilience
Measurable progress over time through repeat assessment
Stronger alignment between cyber controls and business priorities

Skip to process

Book a SAFE intro call

Hands holding a phone by a laptop showing a password lock with connected security and user icons.

Value of the SAFE process

More than a one-off report, SAFE is a cycle

Cyber threats never stay still, and neither should your strategy. As threats evolve, business priorities shift, and the attack surface expands, organisations need an approach that remains agile, adaptive, and grounded in evidence.

SAFE is not just a one-off report or cyber health check. It is a cyclical cyber resilience framework designed to help organisations improve continuously.

SAFE creates that cycle. It helps you assess where you are, prioritise what matters, and improve over time through regular review and strategic adjustment.

Resilience improves in a planned, measurable way
Previous investment can be reviewed againt actual progress
New risks can be identified before they become bigger issues
Leader decisions are based on current evidence, not outdated assumptions
Cyber strategy evolves alongside the business and its risk profile

SAFE helps turn cyber security from a reactive concern into an ongoing resilience capability.

Skip to process

Download SAFE intro pack

Laptop with security shield and lock icon on screen surrounded by arrows, gears, and warning symbols.

"It's like night and day"

Mark Petar, Head of Systems, Montanaro: SAFE webinar guest

"SAFE from ITHQ is not an audit, it's an evidence-based discussion with proportional outcomes aligned to business needs. When management sees the old reports compared with the new ones, they can see exactly where [my budget's] gone, where the time and effort's gone ... We can basically prove: 'Look at the difference we've made.' The SAFE reports provide an independent view of our systems like Pen Tests and are 32 pages long: very useful in many regulation-centric scenarios.

The difference in what ITHQ has done for us as a company is just gigantic."

Watch SAFE webinar

Abstract teal and dark green circular swirl pattern with gradient texture.

The SAFE process

SAFE follows a practical three-step process that builds resilience and delivers ROI

The strength of SAFE is not just in the assessment itself, but in the cycle it creates. Each stage builds on the last, helping leadership teams make better decisions, prioritise investment more effectively, and improve resilience over time.

1. Assess

Build a clear, evidence-based view of your cyber resilience, security posture, and maturity. This establishes a realistic baseline and highlights where risk is highest.

Learn More

Square icon with a dark teal border and white center featuring a dark teal X and an orange triangle at the top.

2. Prioritise

Identify the most important gaps, risks, and improvement areas so leadership attention, budget, and action are focused where they will have the greatest business impact.

Learn More

3. Improve

Turn findings into a practical security roadmap, then review and reassess regularly to strengthen resilience as threats evolve and the attack surface changes.

Learn More

Measurement across 19 domains

Measurement is key to improvement. We use established frameworks within SAFE to create 19 benchmarked domains and score against them.

Our 19 SAFE domains cover all critical areas and can be grouped into 4 main areas of scrutiny: security policies, data protection, exposure and information security management system (ISMS).

A combination of scorecards, reports and visual data representations deliver a detailed, 360 degree view of your resilience profile that enable board level discussions regarding future security spend, and offer proof of improvement activities to cyber insurers, for example.

The spider graphs below are typical of a visual way in which we demonstrate progress. Each point represents one of the 19 domains, with each concentric line a measure of achievement. Resilient businesses will place all points on the green or blue lines ...

Security Policies: All security policies across the business including security team training and security awareness training for other teams

Data Protection: Identity and access management, user and entity behaviour analysis, secure remote access, endpoint protection and data loss prevention

Exposure: Vulnerability management, network and systems security, asset management, observability, incident response management, business continuity

ISMS: Service provider management, information sharing and collaboration, lessons learned and improvement

Radar chart showing SAFE summary scores with zones for Danger, Warning, Good, and Excellent levels around the scale.

Day zero

Radar chart titled SAFE Summary Score Chart showing score from Danger to Excellent across 20 categories.

6 month retest

Radar chart titled SAFE Summary Score Chart shows initial baseline scores with categories ranging from Danger to Excellent.

12 month retest

"We couldn't do it without ITHQ"

Philip Mitchell, IT Director, The Hippodrome Casino

ITHQ has delivered strategy-led, layered solutions to The Hippodrome Casino since 2022. Read the full story ...

Read Case Study

1. Assess

Understand your current cyber resilience position with clarity and evidence

SAFE: Assess reviews your organisation’s security posture across key resilience domains to establish a realistic baseline

This is not a superficial checklist exercise. SAFE uses our blended framework approach to assess how well your current controls, processes, governance, and operational practices support measurable resilience.

The purpose of this stage is to answer the foundational questions. What do you already have in place? Where are the strongest controls? Where are the gaps, dependencies, or hidden weaknesses? How prepared is the organisation to anticipate, withstand, and recover from sustained cyber disruption?

SAFE: Assess:

Evaulates current security posture across key resilience domains
Establishes a clear cyber maturity baseline
Identifies strengths, weaknesses, and potential blind spots
Uses evidence and recognised frameworks rather than assumption
Creates a stronger foundation for decision-making and prioritisation

Assess helps leadership move from uncertainty to an evidence-based understanding of current cyber resilience.

CIS Controls and MITRE logos over a background of hands typing on a laptop with digital padlock icons.

2. Prioritise

Turn assessment findings into clear priorities

SAFE: Prioritise translates evidence into scored analysis, visual summaries, and practical interpretation

Rather than overwhelming teams with technical detail, Prioritise shows where resilience is strongest, where exposure is highest, and which issues need attention first. In short, communicating cyber risk beyond the IT team becomes easier.

Prioritise gives structure to what can otherwise feel fragmented or unclear. It helps organisations understand not only where the gaps are, but how significant they are, how they affect the wider business, and where action will have the greatest impact.

Boards, IT leaders, and operational stakeholders gain a clearer view of current maturity, current priorities, and the implications for resilience, continuity, and investment.

SAFE: Prioritise:

Converts findings into clear scores, summaries, and visual outputs
Highlights priority risks, maturity gaps, and areas of overexposure
Supports stronger board reporting and leadership discussion
Gives context for investment, sequencing and risk-based decision-making
Creates a clear picture of what matters most and why

Prioritise makes cyber resilience easier to explain, easier to govern, and easier to act on.

Bar chart with green, yellow, and red bars showing areas of serious concern and deeper analysis highlighted in red circle.

3. Improve

Build a practical roadmap for stronger resilience

Using the outputs from the first two stages, SAFE: Improve creates a practical roadmap for resilience improvement

This is not about producing a generic wish list. It pinpoints the most important actions, sequencing them sensibly, and aligning them to business priorities, operational reality, and available investment.

The roadmap directs measurable progress over time, potentially including immediate risk reduction, medium-term control improvement, governance changes, better visibility, or more strategic resilience planning. All actions are prioritised, realistic, and linked to business value.

Improve reinforces the ongoing nature of SAFE. Cyber threats do not stand still, and neither should your strategy. As your environment and attack surface evolve, the roadmap is reviewed and refined through repeat assessment, creating an enduring and proven resilience framework.

SAFE: Improve: