“We are fantastic firefighters”

Who Clyde is

Clyde Gregory, IT Manager, Thyssenkrupp Materials UK

Clyde runs a small UK IT team supporting around 400 UK users, with responsibility that reaches into sites in Finland and India. There is no dedicated security person on the team, and, by Clyde's account, no one in the business who knows ISO 27001.

The problem

Clyde put it plainly to the specialist in February 2026:

“We are fantastic firefighters, but we don't have that proactiveness there, because we don't have the tools... So I'm looking for something that would help me to get to that point.”

He wanted ISO 27001, both for its own sake and because, as he said, it gives the business good footing with its clients. A past incident had made prevention personal. And whatever he chose, he had to justify it:

“I know it will bring me value for sure. No worries about that. But I have to prove [it].”

What Luke did

Luke listened first. In August 2025 he and Clyde wrote down what Clyde was trying to achieve, then built a structured needs map Clyde could see and edit: drivers, pains and goals. Along the way Luke helped with the day-job problems too, from printers to sourcing remote-management tools.

When Clyde asked for help with security in October 2025, Luke matched him with one specialist, Citation Cyber, rather than a supplier promising everything. Luke was also a Citation Cyber partner during this engagement. His reasoning, in an email to Clyde: “I think it is better to have specialists in their respective field aligning as partners, opposed to a 'jack of all trades'.” He briefed Citation before the first call, so Clyde did not have to repeat himself, and ran that first three-way meeting around Clyde's agenda: pain points, current tools, the outcomes he wanted and next steps. He then set up a working session with Citation's lead security consultant.

Before the proposal went out, Luke researched the standards that apply in Thyssenkrupp's sector and pushed for a phased proposal Clyde's budget could carry, written for each of the people who would read it. When it arrived he wrote Clyde a two-page board summary in business language, setting out the impact and the options. Clyde had three questions; Luke chased the answers and sent them the same day. He pushed for a fair price on a monitoring service Clyde was considering, and in December reviewed another security vendor Clyde was weighing up, to help inform his decision.

In November Luke asked whether his business case sheet had been useful. Clyde:

“Very, very valuable... Let me talk to [my boss] and get all that feedback and show him.”

And of the specialist he had been matched with:

“They're pretty good. Nick knows the stuff. He understands what we need... It's a good fit with us.”

What changed

Clyde moved first on certification. In December 2025 he signed for Cyber Essentials and Cyber Essentials Plus with Citation, and in January 2026 Nick at Citation confirmed by email that Clyde's business had passed the Cyber Essentials Plus audit. The vulnerability scanning used in that audit showed him more than he expected:

“I like the tool. That opened our eyes quite a lot, I must say.”

A gap analysis against NIST and ISO 27001 followed in early 2026. It was questionnaire-based, and it gave Clyde a scored baseline: where the business stood against each framework and where the gaps were.

That was the material for the board. In February 2026 Clyde told the specialist how he meant to use it:

“Once... the report comes out, we will do a presentation and Luke is going to help me.”

In March he and Luke went through both reports together and agreed to combine them into one presentation. In May he reported back:

“I had my presentation. It went off very well, I must say. The boss was pretty happy... He was quite happy with what we did and what we presented.”

And on where he would turn next:

“If there is anything that comes up on that part, I will always come to you. You know that, right?”