Technology Strategy & Architecture
A costed, sequenced path from legacy estate to a target the business can fund and absorb.
Technology & Data
Cyber & Information Security
Security holds when it is part of how systems are designed, built and changed.
Overview
An institution’s security position rests on everyday mechanics: who can access what, how systems are configured, whether controls operate as described, and whether findings are fixed at root cause.
Those mechanics degrade quietly as the estate changes. New platforms, migrations, integrations, vendors and user groups all change the risk position.
Capmark helps institutions strengthen cyber and information security through operating model, governance, identity, security architecture, control uplift and remediation. Where systems are being changed or replaced, security is built into design and delivery from the start.
What we do
We define how security is run: which risks the institution carries, who owns them, which controls discharge them and how those controls are evidenced. The model covers security, technology and business teams.
We design joiner, mover and leaver processes, privileged access, role design and recertification around what people need to do their jobs. Accumulated access is cleared and ownership is made explicit.
We design security architecture for the estate you actually run: network segmentation, data protection, secure integration, cloud patterns and standards delivery teams can apply.
We design and implement controls across detection, response, backup and recovery, configuration, vulnerability management and monitoring. Control descriptions match what actually operates, so testing and attestation rest on the real estate.
We group findings by underlying cause, remediate the cause, evidence the fix in operation and support closure so issues do not recur.
Every migration, integration and new platform changes the security position. We build access models, data handling, control coverage and security evidence into delivery from the start.
What to expect
A Principal leads from day one. The first weeks establish which controls exist, which operate, where access has accumulated and which findings remain open in practice.
We then build a prioritised remediation and delivery plan, run working sessions with security, technology and business owners, and report position and progress plainly.
Engagements range from targeted security uplift to full remediation and security-by-design support for major change.
01
Assess
Establish the current state, the constraints, the risks and the value at stake.
02
Define
Shape the target model and the business case with the executives who own the outcome.
03
Mobilise
Stand up the team, the plan and the governance around the outcome.
04
Implement
Design, build and test the change, with the business alongside.
05
Sustain
Cutover, hypercare and handover, so the business runs it under its own control.
The same five stages on every engagement, led by senior practitioners end to end. How we work
Client result
Proven in the work, not the pitch.
Superannuation & Pensions
Calypso platform delivery for a major superannuation fund
A Major Australian Superannuation Fund · Liquidity & Treasury Management
We helped implement Calypso for liquidity and treasury operations across the UK and Australia, including trading workflows, venue integration, middle-office design and regulatory reporting. The programme also internalised externally managed portfolios, transitioning mandates and books onto the in-house investment platform and operating model.
- A$10bn
- Portfolios internalised
- $20m
- Programme budget led
- 2 jurisdictions
- Delivered live across the UK and Australia
- Calypso
- Front-to-back treasury platform delivered
Read the case study
Insights
Related thinking.
Get in touch
Talk to a Partner about Cyber & Information Security.
Tell us what needs to change and where the pressure or risk is showing.