Poro Advisory

Private offices guide

Protecting What Matters

Cyber risk, privacy and critical dependencies for private offices.

A practical guide to turning reassurance into evidence — so principals and those supporting them can make confident decisions before an incident forces the issue.

6-page PDF Prepared by Professor Buck Rogers
Front cover of the Poro Advisory private offices guide: Protecting What Matters

What's inside

  • The private office priority

    Protecting privacy and discretion, verifying instructions and payments, and keeping essential activity moving.

  • What matters most

    Five tests — privacy, funds, continuity, dependencies and judgement — to decide which safeguards deserve the strongest evidence.

  • The office conversation

    Nine questions for the people who run the office and its trusted providers, plus a five-minute confidence check.

The private office test

Could your office protect the principal's privacy, verify a sensitive instruction and keep essential activity moving if a trusted person, adviser or system were compromised?

Get your free copy

Tell us where to send it and we'll email you the download link straight away.

We'll only use your details to send the guide and occasional Poro Advisory insights. No sharing, ever.

From the guide

Cyber risk for private offices: turning reassurance into evidence

Could your office protect the principal's privacy, verify a sensitive instruction and keep essential activity moving if a trusted person, adviser or system were compromised? The full guide works through this in detail; here are the essentials.

The questions the office should ask

Use these with the people who run the office and its trusted providers — and ask for examples, evidence and named owners. The core of the guide's nine questions:

  • Which information, instructions and activities matter most to the principal — and what level of disruption or exposure is unacceptable?
  • Who can access sensitive information or act on the principal's behalf, and how are permissions reviewed and removed?
  • How do we independently verify urgent requests and changed payment details, including requests that appear to come from the principal?
  • Could apparently separate services or backups fail together because they share an account, provider, platform or administrator?
  • Who can pause a payment, restrict access or activate the response plan when the principal or head of office is unavailable?
  • Have we tested restoring critical records, reaching advisers securely and operating without normal email or a key individual?

The evidence to request

Long-standing relationships do not replace clear access permissions, independent verification and tested recovery. Five tests — privacy, funds and instructions, continuity, dependencies and judgement — identify the safeguards that deserve the strongest evidence:

  • Recent checks or exercises showing safeguards work, with weaknesses still unresolved made visible.
  • Verification of sensitive requests through a separate, trusted channel using pre-agreed contact details — never details supplied in the request.
  • Key people, advisers and technology dependencies mapped to essential activities, with shared points of failure understood.
  • Escalation routes and delegated authority that are clear when key people are unavailable.
  • Recovery and alternative ways of working tested under realistic conditions.

A practical scenario

Select one sensitive payment or essential office activity. Walk through a credible scenario: a compromised email account, an unavailable key person or a provider outage.

Demonstrate verification, decision authority, secure communication and recovery. Record the gaps and assign owners. The office's real question: could we act with confidence under pressure — or does our confidence depend on everyone being available and everything working normally?

Buck's interpretation

A credible position is a proportionate judgement supported by evidence, with clear ownership of the uncertainties that remain. Clear priorities link privacy, funds and essential activity to specific safeguards; visible evidence — checks, exceptions and unresolved weaknesses — informs decisions.

The confidence check is not a maturity score. One well-evidenced uncertainty is more useful than eight optimistic ticks. Give each gap an owner, a next step and a review date — and make the verification process usable even when the principal is travelling or unavailable, because that is exactly when it will be tested.

The full guide includes all nine questions, the five priority tests and a five-minute confidence check for the office.

Download the full guide