Cybersecurity services
Five services with defined scope and deliverables, available on their own or combined, depending on where your organisation is starting from.
Fractional CISO (vCISO)
Who it’s for: organisations that need security leadership but can’t justify a full-time CISO.
The fractional CISO takes on the security lead role on an agreed part-time basis: setting strategy, managing risk and reporting to the board.
What’s included
- Risk assessment and security master plan
- Prioritising investment and suppliers
- Direction and sign-off of policies and internal standards
- Coordination with your IT team or provider
- Incident management support
- Answering customers’ security questionnaires
Deliverables
- Security master plan and roadmap
- Regular board report with KPIs
- Up-to-date risk register
- Meeting minutes and action tracking
ISO/IEC 27001
Who it’s for: companies whose customers, contracts or growth call for a certifiable ISMS.
Implementing an Information Security Management System to ISO/IEC 27001:2022 and preparing for the certification body’s audit.
What’s included
- Defining the ISMS scope
- Gap analysis
- Risk assessment and treatment
- Selecting and validating Annex A controls
- Internal audit and management review
- Support during the certification audit
Deliverables
- Statement of Applicability (SoA)
- Risk methodology and report
- ISMS policies and procedures, reviewed and signed off
- Risk treatment plan
- Internal audit report
ENS (Spanish National Security Framework)
Who it’s for: public-sector bodies in Spain, and private companies that provide services to them or bid for public contracts.
Compliance with the Esquema Nacional de Seguridad, governed by Royal Decree 311/2022, at the category that applies to your systems.
What’s included
- System categorisation (basic, medium or high)
- Risk assessment
- Selecting and applying Annex II measures
- Direction and sign-off of the security policy and standards
- Preparation for self-assessment or certification audit
Deliverables
- Categorisation report
- Statement of Applicability
- Security policy, reviewed and signed off
- Compliance plan
Business continuity and incident response
Who it’s for: organisations that can’t afford downtime and want to know how they would respond to an outage or an attack.
Preparing your organisation to keep operating through an incident: what gets restored first, how quickly, and who does what.
What’s included
- Business impact analysis (BIA)
- RTOs and RPOs by process
- Scenario-based recovery plans
- Incident management procedure
- Exercises and lessons learned
Deliverables
- Business continuity plan
- Recovery plans
- Annual exercise schedule
- Post-exercise reports
Control implementation and verification
Who it’s for: organisations that know what needs doing and want it done properly.
Implementation and verification of the technical controls that reduce risk straight away, working with your IT team or provider.
What’s included
- Identity, privileged access and multi-factor authentication
- Endpoint and mobile device protection
- Encryption and data protection
- Secure cloud configuration
- Backups and restore testing
Deliverables
- Documented configuration
- Audit evidence
- Operating procedures for your team
From first call to ongoing oversight
Initial call
30 minutes to understand your context, obligations and priorities. No commitment.
Written proposal
Scope, deliverables, timeline and a fixed price before any work starts.
Delivery
Assessment, prioritised plan and implementation, with agreed checkpoints.
Ongoing oversight
KPIs and regular reporting to leadership to maintain the level achieved.
Engagement models
Fixed price
For work with a defined scope: ISO 27001 or ENS implementation and continuity planning.
Monthly retainer
For the fractional CISO service: an agreed time commitment and regular reporting to the board.
Block of hours
For one-off needs or support for your in-house team, with usage reported.
Book an initial call
We’ll look at where you’re starting from and which service fits best.