Case Study: Turbine Media

Building a practical cyber foundation for a micro business supporting critical infrastructure clients

Turbine Media, led by Mark Giddens, engaged SurePath Cyber to strengthen its cyber baseline and establish a clearer path forward under SMB1001.

“We wanted a practical path forward, not complexity for the sake of it. The working register approach gave us a clearer view of where we stood and what we needed to do next.”

As a micro business delivering media and creative services to critical infrastructure clients, including clients in the energy sector, Turbine Media needed an approach that was practical, evidence based, and realistic for a small but growing operation. The goal was not to create unnecessary complexity. It was to put the right foundations in place, improve visibility over cyber risk, and support the business as it continued to grow.

This became increasingly important as client expectations continued to mature across critical infrastructure supply chains, particularly in sectors such as energy where resilience, governance, and supplier confidence are becoming more important.

The challenge

Like many micro businesses working with larger and more compliance driven clients, Turbine Media needed a clearer view of what good looked like in practice.

The business wanted to better understand its current cyber baseline, strengthen day to day cyber practices, review core technical controls, and create a more structured evidence trail. Just as importantly, it wanted to do this in a way that suited a sole operator business with aspirations to grow, rather than adopting an overly complex or enterprise style approach too early.

Rather than treating cyber as a one off technical exercise, Turbine Media wanted a practical uplift that would support current client expectations while also creating a stronger platform for future maturity and business growth.

Our approach

SurePath Cyber was engaged to review the business against SMB1001 Bronze  requirements and support the remediation needed to improve Turbine Media’s baseline security posture.

A key part of the engagement was the use of a working implementation register as the single source of truth for the project. This gave the client one clear place to track requirements, actions, evidence, responsibilities, and status. Instead of multiple disconnected documents, the project

was managed through a live register that remained useful throughout the engagement.

The work focused on practical uplift, including:

• clarifying Bronze requirements in plain business terms

• guiding evidence collection

• supporting owner-led cyber awareness and good security practice

• reviewing baseline controls and key security settings

• discussing firewall configuration and foundational technical controls

• helping prioritise realistic remediation actions

This approach kept the project grounded in the realities of a micro business while still building the structure and evidence needed for a more defensible security position.

The outcome

The engagement gave Turbine Media a stronger and clearer cyber baseline.

By the end of the work, the business had improved visibility over its current position, a clearer understanding of priority gaps, and a practical evidence based path forward. Importantly, the Bronze uplift did more than address immediate requirements. It also established a clear pathway towards SMB1001 Silver and Gold, giving Turbine Media staged next steps for stronger governance, stronger evidence, and increased maturity as the business grows.

For a micro business working with critical infrastructure clients, that matters. Cyb

er maturity is increasingly tied not only to security, but also to trust, supply chain resilience, and the ability to demonstrate that the business is managing risk in a structured and credible way.

Why it matters

"Micro businesses supporting critical infrastructure are often expected to perform like large organisations with none of the resources. Getting the foundations right early changes that equation entirely."

Micro businesses are often expected to meet the standards of much larger organisations when supporting critical infrastructure clients, yet they rarely have the same internal resources or capacity.

Turbine Media’s engagement shows that meaningful progress does not require an enterprise sized compliance program from day one. What it requires is a sensible baseline, a clear plan, and a practical governance led approach that fits the size, risk profile, and growth stage of the business.

By focusing first on Bronze and creating a visible path towards Silver and Gold, Turbine Media is now in a stronger position to support current client expectations and prepare for future uplift as the business continues to mature.

What we do

SurePath Cyber helps micro, small, and growing businesses build practical, evidence based cyber uplift programs that align to business reality, client expectations, and future growth.

For businesses working with critical infrastructure clients, the right cyber foundation is no longer just a technical issue. It is part of building trust, resilience, and long-term capability.