Field Reports — Varde Advisory

Minimum Viable Company Programme · Global Logistics Group

Deciding what actually has to survive first.

A 30,000-employee logistics network had never forced a real answer to the question that matters most in a crisis: what comes back online first, and what can wait.

0Critical functions

0Sites mapped

72h→0hRevenue-critical RTO

2026Engagement year

Read the full case →

Fractional CISOGlobal Automotive Group

Extending a stretched CISO's bandwidth without adding headcount.

At a large automotive group, the CISO's mandate had outgrown one person's calendar: third-party risk, business continuity, disaster recovery, SAP security, policy and documentation, and network architecture all sat on the same desk, alongside everything else the role carried. The gap wasn't capability. It was capacity, and capacity gaps don't show up until something's already been missed.

We split the mandate rather than duplicating it — instead of acting as a full-time replacement, we took direct ownership of third-party risk management, BCM and DR, SAP security, and network architecture, reporting into the same governance the CISO already ran, while the CISO kept the strategic and board-facing work only they could do.

Outcome: workstreams brought under continuous, dedicated ownership, 18 months policy and documentation backlog cleared, and the CISO's calendar freed up for 4 strategic and board-level priorities without capacity drag.

Minimum Viable Company ProgrammeGlobal Logistics Group

Deciding what actually has to survive first in a 30,000-employee logistics network.

A logistics group running a highly distributed, hybrid IT/OT landscape across time-critical supply chains had never forced a real answer to the question that matters most in a crisis: what has to come back online first, and what can wait. On paper, everything looked critical, which in practice meant nothing was properly prioritised.

We started by making the organisation choose. Scenario-based DR plans and live crisis simulations exposed which assumptions about criticality would actually hold. Business Impact Analysis workshops then forced the tiering decision leadership had been avoiding for years.

Outcome: Minimum Viable Company defined across 19 critical functions and the group's 70 sites, RTOs for revenue-critical services cut from 72h to 6h.

Continuity & RecoveryEuropean Energy Provider

Stress-testing a disaster recovery plan that had never actually been tested.

A decentralised energy provider operating across multiple EU countries had disaster recovery capability on paper, but roles were unclear, coverage was fragmented across IT, OT, and organisational layers, and testing had never been pushed hard enough to find the real gaps.

We built scenario-based playbooks across IT, OT, and organisational layers, then tested them through tabletop and live crisis simulations until the real failure points surfaced, not the assumed ones.

Outcome: 80% of critical systems brought under tested DR coverage, downtime risk on priority systems reduced by 30%, and ISO 22301/NIS2 compliance gaps closed from 21 to 3 within 9 months.

Strategic Project ManagementGlobal Automotive Group

Giving a fragmented IT carve-out a single point of accountability.

Following a strategic separation into independent business units, an automotive group had to stand up fully independent IT infrastructure against a fixed, non-negotiable group-wide deadline. Multiple workstreams were already in motion, but with no single point of coordination.

We took governance of the programme end to end: one point of accountability across workstreams and adjacent initiatives, with the discipline to catch a conflict before it became a missed deadline.

Outcome: IT separation completed against the July 2026 deadline, 8 workstreams consolidated under unified programme governance.

Field reports.

Deciding what actually has to survive first.

Extending a stretched CISO's bandwidth without adding headcount.

Deciding what actually has to survive first in a 30,000-employee logistics network.

Stress-testing a disaster recovery plan that had never actually been tested.

Giving a fragmented IT carve-out a single point of accountability.

Initiate engagement.