One of the things that has fascinated me most about working with CyberNorth is that it is a very different type of business. On the face of it it is obvious what it does, or perhaps not. It is a cluster organisation working to support the growth of the cyber security sector in the region.
Scratch below the surface however and it is a very different picture. CyberNorth is a Community Interest Company (CIC), without shareholders and with any profits generated invested back into the community it serves. It has no employees (everyone associated with the company is a contractor) and no assets (other than its data and cash in hand). It doesn’t own any technology. It is almost impossible to describe what its products are and therefore who its customers are.
Yet it is a very real business with a solid presence and demonstrable turnover.
Over the last few weeks I’ve started work on a couple of things that have brought this into focus: Cyber Essentials and BCorp.
In case you don’t know, Cyber Essentials is an effective, Government backed scheme that will help you to protect your organisation, whatever its size, against a whole range of the most common cyber attacks, while a BCorp, or benefit corporation is a type of for-profit corporate entity whose goals include making a positive impact on society.
Filling in the question set for Cyber Essential soon had me flummoxed. How do you secure your technology when you don’t have any? What exactly is it that we are trying to test/prove and why? (The second question is easy: We want to have Cyber Essentials as this is our market and will potentially help us to win future contracts.)
Filling in the impact assessment BCorp soon had me flummoxed. Answering questions such as: ‘How would you describe the positive outcome for customers created by your product/service?’ or ‘Please select the types of companies that represent your Significant Suppliers’ when we don’t really have customers, products and suppliers?
I’m keen to continue with both of these assessments, even if they ultimately don’t lead to accreditation, because they are important for what we are as an organisation and the sector we represent. If I am struggling, then so must many other businesses. I’m going to fill out the question set and impact assessment as far as I can and seek help to address the responses that are beyond me.
Let’s see how far I get.
Thoughts from a Guerrilla Worker 