How the approach works
This page explains how the TrustHarbor approach supports small and very small businesses in making better information security decisions, without unnecessary complexity or overbuilding.
It focuses on how decisions are supported, how work is sequenced, and how clarity is maintained over time.
Why a structured approach is needed
Information security decisions are often made in isolation, driven by tools, urgent issues, or external pressure. Over time, this can lead to fragmented effort, limited visibility, unclear priorities, and difficulty explaining what is in place and why.
The TrustHarbor approach brings structure so effort and investment align with business needs and identified risks.
What TrustHarbor is
TrustHarbor is a practical decision support and governance approach for information security. It is grounded in industry standards and real-world experience.
TrustHarbor provides:
- a way to structure security decisions
- a shared language for discussing priorities and trade-offs
- a structure for organizing planning, evidence, and accountability
TrustHarbor is not a checklist, a tool, or a compliance exercise. It does not replace professional judgement. It supports it.
The core ideas
The approach is built on a small number of ideas that guide how information security programs are understood, evaluated, and improved.
- information security is a program, not a collection of controls
- decisions should be appropriate for the business and its risks
- clarity matters more than completeness
- maturity develops over time, not all at once
Four areas that shape security outcomes
TrustHarbor looks at information security through four practical lenses: people, process, proof, and partners.
Together, these reflect how security shows up in daily operations, how consistently it is applied, how it is supported by evidence, and how external relationships affect risk and trust.
These areas are used to organize thinking and planning, not to prescribe specific controls.
How work typically progresses
While every business is different, work usually follows a simple progression that builds understanding before detail.
- Establish orientation through a maturity assessment
- Clarify priorities and areas that need attention
- Apply a focused risk assessment to understand what matters most
- Develop or adjust the security program in a proportionate way
- Monitor, review, and adapt as business objectives or threats change
Supporting decisions over time
The TrustHarbor approach is designed to remain useful beyond initial setup. It helps maintain clarity as new systems are introduced, partners change, or threats evolve. Decisions can be revisited and explained without starting over.
This makes the security program easier to manage, communicate, and sustain.
How the program is described and maintained
TrustHarbor uses a small set of core program elements to ensure decisions are not only made, but retained and understood over time.
At the centre of this is a Program Description, which captures how the information security program is defined for a specific business, including scope, responsibilities, and how key decisions are made.
A small number of focused Registers are used alongside the Program Description to track assets, priorities, risks, evidence, change, etc. Together, these elements provide continuity as the business, systems, and threats evolve.
Where governance or documentation already exists, it can be incorporated rather than replaced.
Relationship to standards and risk assessment
TrustHarbor is informed by recognized information security standards and practices, but it does not require deep framework knowledge to use.
A formal risk assessment remains an important part of understanding specific exposures and is typically undertaken once priorities and context are clear.
A place to begin
A practical first step is to establish orientation and clarity through a trust and maturity assessment.
A deeper look?
For readers who want more detail, selected excerpts explain how the TrustHarbor approach is applied in practice. View detailed guidance