Steering a cyber transformation inside central government.

More good ideas than money. No shared way to choose.

A UK central government department, partway into a multi-year cyber transformation. The usual shape: a long list of candidate work, a fixed budget envelope, and a board that wanted to know, reasonably, what it was buying, what it was deferring, and what deferring it would cost.

The programme’s answers lived in slide decks and spreadsheets, each assembled by hand, each slightly out of date by the time it was presented. When priorities shifted, the reasoning behind the old plan went with it. And when someone proposed dropping a work package to save money, nobody could say, in the meeting, with confidence, what that did to the department’s position against the NCSC Cyber Assessment Framework.

“What happens to our CAF position if we cut this?” Nobody could answer in the room.

What we did

1. Embedded, not attached

One OTB consultant, inside the small transformation team: same stand-ups, same deadlines, same tea rota. Not a reviewer at arm’s length; a member of the team accountable for the plan being honest.

2. Put the scope on one table

Every candidate work package scored for benefit and effort, with the weightings agreed openly, so “why is this above that?” always has an answer, and the answer isn’t “because someone senior said so”.

3. Made change control mean something

The baseline is the baseline. Every change to it is logged with a justification, so the programme’s history reads as a series of decisions, not a series of surprises.

4. Tied scope to the CAF

Each work package mapped to the CAF outcomes it supports. Propose cutting one, and the effect on the department’s CAF position appears alongside the saving, before the decision, not after it.

5. Steered against money and benefit

Finance forecast against the budget envelope and benefits tracked to realisation, side by side, so “can we afford it?” and “is it working?” are answered from the same place.

6. Generated the board pack

Board reporting produced from the live programme data. The pack is a print-out of reality, not a fortnight of curation, and the meeting starts from the same numbers the team works from.

What made it different

• A purpose-built delivery tool. The scoring, change control, CAF mapping, benefits tracking, finance forecasting and board packs all run in one system: an OTB product, used live on this programme.
• Decisions made in the open. The weightings, the trade-offs, the change log: visible to everyone who has to live with them. Nothing hidden.
• Plain-English governance. Every work package described in language its owner can defend in one sentence. If your people can’t explain it, it isn’t security.
• Security as delivery, not compliance. Each piece of work carries a benefit the department can point to. The CAF is mapped behind the programme; it isn’t the reason for it.

Where it stands

The programme is scoped, baselined and steered from a single live picture. Prioritisation arguments happen once, in the open, and stay settled, because the reasoning is written down where everyone can see it. Scope changes are decisions with justifications, not drift. And when the board asks what excluding a piece of work does to the department’s CAF position, the answer is on the screen, not owed as an action.

Most of all: the people who own the risk can see the programme as it is, while there’s still time to steer it.