Discover how Airbus Protect designed and executed a tailored security assurance project for a major UK pension trustee
The challenge: Elevating security governance in a dynamic threat landscape
In response to an evolving cyber threat environment and updated mandates from regulatory bodies such as The Pensions Regulator (TPR), the trustee of a £1.4bn pension scheme recognised the need for a more robust security assurance framework. The objective was to ensure that its third-party service providers met the highest standards of data protection and operational resilience to safeguard the sensitive information of its members.
Our approach: A comprehensive, phased assurance framework
Airbus Protect Ltd was commissioned to design and execute a tailored security assurance project. Our methodology centred on a dual-tier review process, utilising a detailed information security questionnaire. This assessment tool was meticulously mapped to the 17 control domains of the Effective System of Governance (ESOG), covering:
• Governance and Risk Management
• Technical Security and Data Protection
• Operational Continuity and Incident Management
The journey: Collaborative remediation and enhanced compliance
Our phased approach allowed for the clear identification of areas for improvement and a structured roadmap for achieving satisfactory assurance levels:
• Initial baseline assessment: We conducted a thorough review of all key service providers, categorising them into Tier 1 and Tier 2 based on the criticality of the services provided.
• Targeted remediation: For providers where initial gaps were identified, such as certification lapses or procedural inconsistencies, we worked collaboratively to define and implement mandatory remediation actions.
• Verification of controls: We facilitated the submission of independently validated evidence, including international security certifications (e.g., ISO 27001) and government-backed cyber hygiene standards (e.g., Cyber Essentials Plus).
The outcome: Achieving conclusive end-to-end assurance
As of April 2026, the project successfully reached a robust level of compliance across the trustee’s entire service provider ecosystem:
• 100% satisfactory ratings: All evaluated service providers achieved a “Satisfactory” assurance rating, indicating full compliance with the trustee’s security requirements.
• Strengthened resilience: Comprehensive operational assurance was confirmed, affirming that all service providers maintain a leading standard of protective and continuity protocols.
• Sustainable governance: We established a streamlined Annual Due Diligence process, enabling the trustee to maintain continuous monitoring of provider security postures through a risk-based filter.
• Formal board endorsement: The final assurance reports detailing all outcomes and recommendations were submitted for review and endorsement by the trustee board.
Why chose Airbus Protect?
This project demonstrates how a proactive and structured approach to security assurance can transform regulatory obligations into a strategic advantage. By partnering with Airbus Protect’s specialist security teams, the trustee of this £1.4bn pension scheme has successfully mitigated its third-party risk posture and established a culture of verified, ongoing security governance.