A lot is in place
Measures, suppliers, systems and reports are present.
A Reality Check for cyber, IT and AI
Make digital dependency governable
Hartwich Risk & Resilience helps executives, boards and owners see what critical processes depend on, what is vulnerable, who is accountable and where evidence is missing.
The fixed line of enquiry
Five questions reveal what matters at executive level
One fixed line of enquiry. Five simple questions.
ContinuityWhat must not stop?
The critical process, service, customer promise or information that is directly hit by disruption.
DependencyWhat does it depend on?
The systems, suppliers, data, access rights, processes or AI applications beneath that critical process.
ExposureWhat can go wrong?
The disruption, error, attack, decision failure or dependency that becomes business-relevant.
OwnershipWho is accountable?
The person or role accountable for the decision, follow-up, effectiveness and accountability.
EvidenceWhere is the evidence?
The evidence that agreements, measures and decisions exist, are carried out and work as intended.
For organisations that recognise this
A lot is in place, but the overall picture is fragmented
Policies, suppliers, tools and reports only create value once it is clear which critical dependency they control, who is accountable and what evidence counts.
Not enough coherence
Loose certainties do not yet form a governable whole.
Ownership and evidence
It is not always clear who is accountable and what shows it works.
The real starting point
You know what must not stop
The Reality Check examines whether those dependencies are clear enough to steer on.
Governable means: clear what is critical, what it depends on, what can go wrong, who is accountable and where the evidence lies.
Customer processCare processSupplier or MSPCritical applicationSensitive dataAI use case
The Reality Check does not start with technology, compliance or standard checklists. It starts with what must not stop and tests what lies beneath it.
Every assignment starts here
One concrete executive question defines the scope
A Reality Check is only valuable when it is clear what the executive, board or owner needs answered.
One questionOne domainOne processOne supplierOne systemOne AI use case
Can we demonstrably steer this critical supplier?
Are the dependencies beneath our critical process governable?
Is our trust in this AI application sufficiently substantiated?
Cyber, IT, AI or a combination
The scope follows the executive question
Sometimes it is cyber. Sometimes IT. Sometimes AI. Often the question touches several domains at once.
Cyber
Digital threat, data breaches, ransomware, access management, incident response, NIS2 pressure.
IT
Systems, applications, infrastructure, cloud, MSPs, continuity and technical debt.
AI
AI use, data, output, agents, human approval, logging and permissions.
Combination
AI on customer data, security at an MSP, cloud dependency or a digital supply chain.
What you receive
A compact executive overview
A sharp view of what is substantiated, what rests on assumptions, where ownership is missing and which decisions are needed.
From analysis to decision.
Accountability becomes manageable once it is clear what needs attention first, who is accountable and what evidence is missing.
- Executive core question and scope
- Core picture of the critical dependencies
- Main exposure and uncertainties
- Decisions that are explicitly required
- Ownership and execution
- Available and missing evidence
- Where fitting: 30/60/90-day advice
Practical indication
A scoped Reality Check with a fixed starting price
The final price depends on the executive question, the chosen scope and the information available.
From €4,990 excl. VAT
A scoped Reality Check with limited document review, analysis, executive interpretation and a compact memo.
- One executive core question
- A bounded scope
- No hourly rate as the starting point
Deliberate boundaries
A fit when you seek governable insight
Not a fit when you want to outsource execution, certification or formal assurance.
Fits with
- A concrete executive question
- Uncertainty about cyber, IT or AI
- A fragmented overall picture
- Preparing a decision
- Evidence is missing or unclear
Does not fit with
- Audit or pentest
- Formal assurance statement
- Certification
- Implementation project
- Tool selection or interim CISO
How the Reality Check works
Focused enquiry, limited burden, clear outcome
The method is compact: sharpen the question, review the relevant information, formulate conclusions and explain them at executive level.
1
Sharpen the executive question
2
Work through the five questions
3
Review the relevant information
4
Analysis and executive interpretation
5
Compact memo and briefing
Why Hartwich Risk & Resilience
Executive language is only valuable when the operational reality holds up
I am Erik Hartwich. Since 1990 I have worked in the digital systems organisations run on: as a network and systems administrator, infrastructure architect and security advisor. From the data centre of a retail group to the security standards of one of the largest telecom operators in the Netherlands. Not from the boardroom, but from the operations beneath it.
That background is why a Reality Check holds up. I have seen up close where executive assumptions and technical reality diverge, and I test whether that is the case for you.
Experience as a touchstone, not a story.
Most of what runs in a data centre I have in practice built, managed or improved. I use that depth to test whether the executive picture matches what actually lies beneath it.
- Technical depth without unnecessary jargon
- An eye for systems, suppliers and processes
- Independent assessment
- A sharp separation of dependency, ownership and evidence
No tools, no implementation, no stake in the outcome. My full career is on LinkedIn.
Going deeper
Insights on cyber, IT and AI risk
Short analyses of situations where digital dependency becomes relevant at executive level.
Cyber
Effectiveness not demonstrable enough
When security measures exist, but their effectiveness is not visible enough.
IT
Dependency becomes critical
When systems, suppliers or technical debt become business-critical.
AI
AI use grows faster than decision-making
When AI grows faster than decision-making, permissions, logging and human approval.
Starting point
Discuss your question
In a short conversation we determine whether a Reality Check fits, which scope is logical and which decision must be prepared.
- What is the trigger?
- What must not stop?
- What must you be able to decide?
