About the author

Jeffrey, CISSP, AAISM, CISO

Chief Information Security Officer of Infracom Consultancy Integration since 2008. Every file in this store comes from the management systems he built and still runs.

A consultant brings these files and a day rate. This store brings the files.

See the products Infracom

The short version

Built once, run every day, written down so others can run it

Jeffrey has run security for twenty years and Infracom since 2008. Infracom is a licensed Singapore cybersecurity firm: an ISO/IEC 27001 certified organisation, a CREST Pathway+ organisation, licensed for penetration testing and managed security monitoring, and now going through ISO/IEC 42001 certification.

He designed the company's management system himself and is its approving authority. One system carries every scheme; every control is written once and mapped across them. The AI management system inside it is the source of the AI Governance Pack: the inventory, the risk and impact assessment, the registers, the statement of applicability and the clause map are the ones Infracom runs, with the company data taken out.

Policy on paper is not his measure. The first audit is. So every register has an owner and a review date, every procedure has a template behind it, and the reader's guide lets a new assessor run the system without the author in the room. That is the standard the store's files are written to.

What he built and runs at Infracom

Not written for a shop. Written for an auditor.

One management system, every scheme

Infracom runs one documented management system that carries ISO/IEC 27001:2022, ISO/IEC 42001:2023, the CREST requirements, the licence conditions and the national cyber trust certification. Every control is written once and mapped across the schemes, so an auditor finds the clause in one place.

The AI management system

AI Policy, AI Lifecycle Procedure, AI System Inventory, AI Risk and Impact Assessment, AI Legal Requirements Register, Automated Decision-Making Register, AI Training Data Registry, the ISO/IEC 42001 Statement of Applicability and an AI penetration testing method. Audited internally on its own programme and now in certification.

Privacy and personal data

The personal data protection policy, data masking and deletion procedures, information classification and the legal and contractual register that tracks every data protection obligation.

Registers that stay alive

Risk, assets and access, incidents, legal and contractual, licensed services and evidence, each with a named owner and a review date. The annual risk assessment, the internal audit programme and the management review run on a calendar, not on memory.

Licensed and certified operations

An ISO/IEC 27001:2022 certified organisation, a CREST Pathway+ organisation, licensed for penetration testing and managed security monitoring.

Twenty years of advisory work

Security architecture review and endorsement, risk assessment, policy and procedure development, control mapping and audit readiness for government, critical infrastructure, financial sector and enterprise programmes. Qualified as an independent security reviewer on government programmes.

Credentials

On the certificate and in the work

CISSP: Certified Information Systems Security Professional, ISC2
AAISM: Advanced in AI Security Management, ISACA
ISO/IEC 27001:2022: Infracom certified organisation
ISO/IEC 42001:2023: Infracom certification in progress
CREST: Infracom is a CREST Pathway+ organisation
Data Protection Practitioner: Personal data protection, Singapore
MSc: Business Management, IT Management
BSc (Hons): Computing

How he works

Twenty years at the client's table

Jeffrey's consulting work is governance, risk and compliance for government, critical infrastructure, financial sector and enterprise programmes: independent security architecture review and endorsement, threat and risk assessment, policy and procedure development, control mapping, gap assessment and audit readiness. He has served as the independent security reviewer on government programmes, from design review to go-live endorsement.

His method is the same on every engagement. Take the policy, turn it into working processes: an inventory, an impact assessment, a register, a named owner and a short review cycle. Then train the owners so the programme survives after the consultant leaves. He speaks to the engineer's desk and to the board in the same week.

Client names are withheld under confidentiality. The worked examples in the store are built from that work with every name and figure changed.

Selected engagements

Risk assessment, architecture review and governance, at the client's table

Independent security reviewer

Government and critical infrastructure programmes, 2024 to 2025

Independent review and endorsement of the security architecture, deviation and waiver assessment, security acceptance testing oversight and go-live endorsement on two concurrent programmes.

Cloud application programme

Transport, 2022 to 2023

Risk assessment, design review, threat risk assessment, security test scenarios and cases, and compliance review for a cloud-hosted application.

Network migration programme

Transport, 2021 to 2022

Security design review, configuration review and a STRIDE threat risk assessment across the migration.

Multi-agency programme

Public sector, 2018 to 2021

Risk assessment, design and compliance review, and the security management plan, incident response procedures and supporting policies, written and handed over.

Client names withheld.

Where to start

The policy is adopted. The first three steps.

Find the AI you already use
Every tool, agent and integration, with the business use behind it, including what staff adopted on their own. The risk sits in the AI nobody listed.
Name the owners
A business owner per use, one accountable person for the programme, and working tools in their hands: the impact assessment, the register, a short review cycle.
Run one impact assessment end to end
The highest-risk use first, the one touching personal data or decisions about people. Fix what it finds and record it. Everything after is repetition.

Why this store exists

The files a consultant brings, without the day rate

Infracom's clients pay for the files to be adapted to them. The store sells the files themselves, with a single business licence, free updates for life and the author one e-mail away.

See the products [email protected]

Infracom on LinkedIn · www.infracom.com.sg