There are different types of consulting services - you could assess many parts of someone's cyber security preparedness without knowing technical details about security, as weird as that sounds.
Does management make it a priority?
Is there appropriate funding?
Are the correct policies in place?
And so on.
Of course, if you ignore th and technical details you will have very serious issues.
That said, you shouldn't send a super technical security expert to interview executives about their culture around cyber - the expert will find it boring/beneath them, the execs won't like the expert... etc
Does management make it a priority? Is there appropriate funding? Are the correct policies in place?
And so on.
Of course, if you ignore th and technical details you will have very serious issues.
That said, you shouldn't send a super technical security expert to interview executives about their culture around cyber - the expert will find it boring/beneath them, the execs won't like the expert... etc