Joe Ferguson

WORK HISTORY

EDUCATION

SKILLS

ABOUT JOE FERGUSON

I enjoy an ongoing part-time consultancy to Govia Thameslink Railway while reaching out to others in transportation who need temporary or part time cyber security support. I specialise in Risk Management and Cyber Compliance (NIS, ISO, CE etc). I am particularly interested in helping other organisations in the transport industry to achieve a high level of cyber maturity, and attain standards of excellance through compliance with ISO 27001 and Cyber Essentials. I have recently been heavily involved in updating cyber security policy for both the Home Office and MOD and have revised all of GTR\'s policy to reflect the needs of ISO 27001:2022, CE and NIS, while risk assessing all critical IT systems, submitting the CAFs to DfT and producing the ISMS and other documentation in pursuit of GTR\'s ISO 27001 certification. To which end I am both a certified implementor and auditor.My risk assessment are based on ISO and 27005 though they are strongly influenced by IEC 62443 and TS 50701. These assessments include both IT and OT systems and networks, including a thorough risk analysis recently on the C717 (ERTMS) for Great Northern, following my earlier assessment of the C700 for Thameslink and the Bombardier (Alstom) Electrostar upgrade to ETCS.In parallel with my involvement with GTR, I have provided cyber consultancy to Sellefield, MOD and the Home Office as well as the D & BS. I started working life as a programmer with the Home Office and moved to the MOD where I left in 1997 having reached Grade 6 in charge of all voice and data networks for DERA but forced out by privatisation. Since then I have run a number of coansultancy companies, myself as a CLAS consultantant, now CCP SIRA,and with clients in telecoms,(BT/Orange/Nortel) industry (Semantec, BAE,), banking (HSBC/Capital One), central government (MOD, HO, DfT, DWP, EA) and major police services (MPS/TVP).