No. ABCOM does not guarantee the prevention of cyber attacks, fraud, or financial loss.

ABCOM provides Managed IT Support and, where agreed, specific security controls as defined in your Service Agreement and Statement of Work (SOW). These services are designed to reduce risk, not to eliminate it.

Cyber security is a shared responsibility between ABCOM and the client organisation.

---

What ABCOM is responsible for (in scope)

Under a standard Managed IT Support agreement, ABCOM is responsible for delivering the services and controls explicitly listed in your SOW, which may include:

• System and device patch management
• Endpoint protection deployment and health monitoring
• Backup monitoring and recovery assistance
• Firewall and network security management
• User account provisioning and removal
• Change management, ticketing, and service reporting

ABCOM’s obligations are limited to the controls expressly included in the agreed scope.

---

What is not included in scope

Unless explicitly stated otherwise in writing, ABCOM does not manage or control:

• Payment authorisation or financial approval processes
• Verification of supplier bank detail changes
• Client-side business procedures or internal controls
• User decision-making, vigilance, or compliance with policies
• Whether staff correctly follow MFA, security training, or internal processes
• Fraud prevention relating to authorised payments

Incidents such as Business Email Compromise (BEC) typically arise from failures in business processes rather than failures of IT infrastructure.

---

No guarantees or implied warranties

ABCOM does not warrant or represent that:

• Cyber incidents will be prevented
• Fraudulent activity will be detected before impact
• All threats can be blocked or eliminated

Any statements regarding security are statements of control delivery, not guarantees of outcome.

---

Frameworks and best practice

Where security services are provided, they are aligned with recognised control frameworks (such as Cyber Essentials, NIST, or ISO 27001) and delivered as defined technical controls, not as assurances of protection.

These frameworks explicitly recognise that human behaviour and business processes remain the organisation’s responsibility.

---

Client responsibilities

The client remains responsible for:

• Financial controls and approval workflows
• Staff awareness, training attendance, and compliance
• Verification of payment requests and changes
• Enforcement of internal policies and procedures

Failure to maintain these controls materially increases cyber and fraud risk.

---

In summary

• ABCOM delivers exactly what is defined in the SOW
• Security services are control-based, not outcome-based
• Cyber risk cannot be eliminated — only managed
• A clear scope protects both parties and ensures effective service delivery

If you would like to review your current scope or understand where responsibilities sit, we are happy to explain this clearly.