Information Security & ISMS
Establishing, improving and operationalising a management system that fits the size and working reality of the organisation.
Independent cyber security advisory
Cyber security. Pragmatic. Risk-based. Achievable.
Information security advisory for organisations that want to understand their risks, build effective security structures and prepare for ISO 27001, NIS2 and customer or compliance audits — without unnecessary complexity.
No obligation · 30 min intro call · No pitch
Advisory areas
Where I can help
Six areas that complement each other in practice. Current core focus: ISO 27001 and building an ISMS that works in day-to-day operations.
ISO 27001 consulting & audit support
Gap analysis, maturity assessment, documentation structure and support through to the external audit.
Cyber risk & compliance readiness
Assessing risks in a structured way, interpreting contractual and regulatory requirements and prioritising gaps.
Security governance & operating model
Responsibilities, processes and decision paths that make security manageable over time.
External ISO / vCISO support
Temporary or ongoing security expertise for organisations without a full-time security function.
Data-driven risk prioritisation
Using existing data from operations, monitoring and assessments to focus effort where it matters.
Consulting approach
Why CyberSteer
Risk-based
The focus stays on the risks that actually matter to your organisation.
Practical
Measures have to work in real operating environments, not only on paper.
Technical & understandable
Technical security topics are translated into decisions management can make.
Documented & audit-ready
Clear responsibilities, evidence and traceable decisions.
Our approach
Developing security in a structured way
From risk assessment through governance and implementation guidance to verification and continuous improvement – a pragmatic approach that aligns security with the risks, requirements and capabilities of your organisation.
- 01
Understand
Risks & requirements
- Identify risks.
- Put requirements into context.
- Set priorities.
- 02
Structure
Governance & ISMS
- Clarify responsibilities.
- Establish structures and processes.
- 03
Guide
Security in practice
- Define concrete measures.
- Guide implementation.
- Find practical solutions.
- 04
Verify
Assurance & compliance
- Check effectiveness.
- Meet requirements.
- Provide evidence.
- 05
Evolve
Security & ISMS
- Respond to change.
- Adjust priorities.
- Improve continuously.
Continuous improvement
The advisor behind CyberSteer
Salih Köse
Cyber Security Advisor
- CISM – Certified Information Security Manager
- CCSK – Certificate of Cloud Security Knowledge
You work directly with me, as an independent information security advisor.
My background combines technical cyber security, security operations and security management: from network and security engineering through leading a SOC to responsibility for cyber security at organisational level, including international and regulated environments.
Insights
Latest articles
Articles on ISO 27001, ISMS, cyber risk, security governance and security operations.
Information Security
Information Security Should Fit the Business
Information security should reflect an organisation’s actual risks, requirements and capabilities. The key is setting the right priorities and building a realistic path forward.
Salih KöseReading time: 7 min
Where does your information security stand today?
An initial conversation helps to clarify the current situation, the priorities and reasonable next steps.