Skip to content
CyberSteer

Services

Information security advisory that holds up in practice

Five advisory areas that reflect the actual scope of the work. In practice they interlock: an ISMS only becomes effective when risk, governance and security operations fit together.

01

ISO 27001 & ISMS

Assessing, establishing and improving an information security management system — with the goal that it is actually used, not merely produced for an audit.

  • Gap analysis and maturity assessment
  • Scope, policies and documentation structure
  • Risk management process and treatment planning
  • Support through to the certification audit
02

Cyber risk & security governance

Making risks transparent and defining responsibilities so that security decisions can be made and traced.

  • Risk assessment and prioritisation
  • Roles, responsibilities and decision paths
  • Security policies and target state
  • Reporting suitable for management
03

SOC & security operations advisory

Support for building and improving security monitoring, detection and incident processes — from someone who has run these operations.

  • Review of monitoring and detection
  • SOC processes and work with service providers
  • Incident handling and escalation paths
  • Effectiveness rather than tool focus
04

Audit & compliance readiness

Preparation for external audits, customer assessments and contractual or regulatory security requirements.

  • Preparation for ISO 27001 and customer audits
  • Review of security requirements in contracts
  • NIS2-relevant positioning
  • Evidence and documentation
05

Ongoing security advisory

Continuous expertise for organisations without a dedicated full-time information security function.

  • External ISO / vCISO support
  • Regular alignment and prioritisation
  • Support with day-to-day security questions
  • Support for projects and supplier requests

When this support is relevant

  • A customer or partner requires ISO 27001 or a security audit.
  • An ISMS exists on paper but is not lived in practice.
  • Security responsibility is spread across roles and not clearly steered.
  • Regulatory requirements such as NIS2 become relevant.
  • There is no internal full-time information security function.

Where does your information security stand today?

An initial conversation helps to clarify the current situation, the priorities and reasonable next steps.

Request a consultation