The Royal Parks (TRP) is a UK charity entrusted with the stewardship of over 5,000 acres of historic parkland in London, including Hyde Park, Regent’s Park, and Richmond Park. Their digital infrastructure underpins a broad range of operational and public-facing services, from managing ecological data and staff operations, to facilitating events and supporting public engagement.
As part of a wider programme of strategic digital investment, TRP partnered with i3Secure to enhance their cyber security governance, align with recognised national frameworks such as NCSC’s Cyber Assessment Framework (CAF), and build long-term resilience in an increasingly complex threat landscape.
Our consultants integrated seamlessly into The Royal Parks’ organisational structure, collaborating closely with the IT department to deliver assurance based on Cyber and Information Security best practices.
Guided by their Head of IT, our team planned the project using accessible tools that enabled effective communication and progress reporting to senior leadership. Our consultants used tools such as Azure DevOps to structure the work into well-defined sprints and produced regular highlight reports to demonstrate completed tasks and the value delivered—ensuring full transparency and clear return on investment.
Our Subject Matter Experts selected the most appropriate cybersecurity framework to guide the project and measure progress. In tandem, we supported the IT Infrastructure Manager with technical expertise to deliver practical, business-ready solutions. To meet all requirements, i3Secure deployed a well-rounded team of consultants with specialised skills in Governance, Risk, and Compliance, as well as hands-on technical delivery.
To set TRP on the path to long-term cybersecurity success, i3Secure began with a comprehensive discovery assessment aligned with the National Cyber Security Centre’s (NCSC) Cyber Assessment Framework (CAF). This evaluation provided a clear picture of TRP’s existing controls, systems, and procedures—highlighting both strengths and vulnerabilities—and gave us a strong foundation to build from.
We selected the NCSC CAF due to its alignment with public sector needs and complemented it with elements from ISO 27001 and Cyber Essentials to support the organisation’s broader compliance goals. To guide the assessment, we created a bespoke, live gap analysis tool that tracked CAF compliance and progress in real time. Based on the findings, we developed a tailored, prioritised roadmap of strategic recommendations to strengthen TRP’s cybersecurity posture.
Following the discovery phase, we launched delivery with a custom risk register based on NIST 800-30, identifying key threats, assigning risk ratings, and introducing mitigation controls aligned to ISO 27001. We also established a Cyber Security Committee to oversee governance and supported the IT team by enhancing core policies and procedures for greater control over network and application security.
To improve asset management, we introduced policies to track and maintain hardware and software with secure configurations. We strengthened application security through secure development practices and implemented a formal review process. For supplier risk, we designed three tailored questionnaires, enabling TRP to assess third-party vendors regardless of contract size.
Endpoint protection was reinforced through antivirus audits and updates. We also reviewed access controls and server configurations with targeted improvements—particularly within TRP’s virtualised environment—and audited external firewalls to validate the business justification of open ports.
We advanced business continuity by validating TRP’s continuity plan and developing a new, tested IT Recovery Plan. To build internal awareness, we rolled out a cyber awareness roadmap including phishing simulations, workshops, and e-learning. We formalised cyber governance by launching a Cyber Security Steering Group with structured meetings and documentation.
Incident response maturity increased significantly through the development and testing of a comprehensive response plan, including a live brute-force attack exercise. We further enhanced assurance through grey-box and black-box penetration testing—both internal and external—which confirmed the effectiveness of controls and revealed additional technical vulnerabilities to address.
To conclude, we delivered a clear roadmap to guide TRP toward cyber compliance certifications, including an internal audit plan and actionable steps toward Cyber Essentials and Cyber Essentials Plus.
By acting on our consultants’ recommendations, The Royal Parks significantly strengthened their security posture, achieved higher levels of regulatory compliance, and safeguarded sensitive data across their systems. Their compliance with the NCSC Cyber Assessment Framework rose sharply from 61% to 95% for fully met controls—marking a substantial leap in cybersecurity maturity.
With core foundations now firmly in place—including robust risk management, auditing, incident response planning, business continuity strategies, and well-defined policies—TRP has gained greater confidence in its cyber resilience. This partnership has enabled The Royal Parks to build a more secure digital infrastructure, better prepared to withstand emerging threats and adapt to evolving regulatory and technological demands.
Jason McAdam, Co-founder & Director of i3Secure commented on the work:
Download the Case Study“From a technical perspective, this engagement showcased our ability to combine deep security testing with practical control implementation. The penetration testing we conducted provided valuable assurance over TRP’s digital defences, while our work on access controls, asset management, and configuration hardening ensured those defences were robust and actionable. It’s a great example of how we don’t just assess risk, we engineer resilience.”
Get in touch with our specialists to learn how we can enhance your cyber security posture.
Contact Us 
Contact