Consulting

Information Security

Security that proves itself in audits and holds up day to day.

We raise your company’s security maturity, reduce risk exposure and prepare the way to certifications such as ISO/IEC 27001 and SOC 2. Every control we put in place is born with the evidence the auditor will ask for.

ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27005
NIST CSF 2.0
NIST RMF
CIS Controls v8
SOC 2

Request a proposal Chat on WhatsApp(opens in a new tab)

The challenge

Security that proves itself in audits and holds up day to day.

Controls without proof

Purchased tools and written policies are not enough when customers, auditors or regulators ask for evidence.

Priorities set by noise

Without a risk map, investment goes to the latest incident, not to what exposes the business the most.

A program that loses momentum

After certification, routines, metrics and owners must keep working, or the next cycle starts from scratch.

How we help

Workstreams

Security Uplift

Goal

Quickly raise Information Security maturity, reducing risk exposure and increasing resilience, based on recognized frameworks (ISO 27001/27002, NIST, CIS Controls and SOC 2) and a Defense in Depth architecture.

What we do

Security Assessment

Maturity assessment (people, processes and technology).
Map of risks, critical assets and third parties.
Control and evidence gaps, and an action plan.

ISO/IEC 27001 and 27002

Scope and design of the ISMS (Information Security Management System), developing its governance, policies and processes.
SoA and a risk based implementation plan.
Controls in place with audit ready evidence.

NIST

Plan by function (Govern, Identify, Protect, Detect, Respond and Recover).
Controls prioritized by criticality and environment.
Governance metrics and routines to sustain the program.

CIS Controls

Assessment by control, safeguard and implementation group.
Quick wins and incremental execution with measurable gains.
Owners, metrics and auditability.

SOC 2 Readiness

Gap analysis against the Trust Services Criteria.
Operational controls and an evidence repository.
Preparation for the audit and the observation period.

Defense in Depth

Layered architecture.
Specification of the tools for each layer.
Drafting of policies, processes and controls.

Certification readiness

Goal

Prepare the company to achieve ISO/IEC 27001 and/or SOC 2 with minimal rework, structuring governance, controls and auditable evidence, ready for the external audit and for sustaining the program day to day.

What we do

ISO/IEC 27001: readiness and implementation

Definition of the ISMS scope, context, interested parties and objectives.
SoA (Statement of Applicability) and risk treatment plan.
Essential policies, standards and processes, with roles and responsibilities.
Evidence library and audit preparation (internal audit, and support during the external audit).

SOC 2: readiness and evidence

Assessment against the Trust Services Criteria (Security, plus additional criteria where applicable).
Design and operation of controls (policies, procedures and routines).
Evidence repository, control testing and support during the observation period.
Preparation of the "audit pack" and alignment with the independent auditor.

ISO 27001 and SOC 2 together

Convergence map: common controls and the specific requirements of each framework.
A single governance, risk and evidence model that serves both.
Integrated roadmap (quick wins and a maturity track), cutting cost and duplication.
End to end project management: schedule, owners, checkpoints and final readiness.

Risk Management

Goal

Establish and run an ongoing Cyber and Information Security Risk Management process that brings business and technology together to identify, assess, treat and monitor risks, with clear criteria, evidence and governance, aligned with ISO/IEC 27005 and the NIST RMF.

What we do

Cyber and information security risk program

Definition of scope, assets, critical processes and dependencies (including third parties).
Risk criteria: impact, likelihood, appetite, tolerance and scales.
Risk register, prioritization and a treatment plan with owners and deadlines.
KPIs and KRIs, committee meetings and recurring follow up.

ISO/IEC 27005: method and operation

Complete methodology: risk identification, analysis, evaluation and treatment.
Links between risk, control and evidence, for audits and continual improvement.
Model for risk acceptance, exceptions, periodic review and lessons learned.
Integration with the ISO 27001 ISMS, where applicable.

NIST RMF: governance and controls

RMF structure: categorize, select, implement, assess, authorize and monitor.
Control selection and baseline according to the criticality and context of the environment.
Support for authorization packages, acceptance and evidence trails, when required.
Continuous monitoring and risk based change management.

CISO as a Service and GRC

Goal

Provide ongoing support to sustain and evolve the Information Security program, with governance, risk based prioritization, disciplined execution and consistent evidence, working at both strategic and operational levels through CISO as a Service and recurring GRC (Governance, Risk and Compliance) support.

What we do

CISO as a Service

Executive direction: strategy, roadmap, budget and risk based priorities.
Governance: committees, meetings, reporting to leadership and metrics (KPIs and KRIs).
Oversight of critical controls (IAM, logging, vulnerabilities, incidents and backups).
Support in decisions and crises: incident response, communication and lessons learned.
Preparation for and follow up of audits and certifications (ISO 27001 and SOC 2).

Recurring GRC

GRC operation: risk register, acceptances, exceptions and treatment plan.
Management of policies, standards and evidence, with version control and auditability.
Assessment of changes (projects and suppliers) and of their impact on risks and controls.
Light internal audits (health checks) and verification that actions are effective.
Working with key areas (IT, Development, Infrastructure, Legal, Procurement and HR) to get things done.

Audits

Goal

Assess, independently and based on evidence, the effectiveness of controls and adherence to the requirements of ISO/IEC 27001/27002 and SOC 2, identifying nonconformities, risks and opportunities for improvement, with a clear action plan to raise maturity before external audits.

What we do

ISO 27001/27002 internal audit

Annual planning and definition of scope, criteria and sampling.
Interviews, control testing, document review and evidence validation.
Assessment of adherence to the ISMS (context, leadership, risk, operation and improvement).
Report of nonconformities, observations and prioritized recommendations.
Support for the action plan: owners, deadlines and effectiveness checks.

SOC 2 internal audit

Assessment of control design and operation against the Trust Services Criteria.
Control testing and evidence checks for the observation period.
Identification of auditability gaps (traceability and consistency).
Executive report, remediation plan and preparation of the "audit pack".
Retesting of critical controls to confirm fixes before the external auditor arrives.

References

Standards, laws and frameworks that guide the work and the evidence.

ISO/IEC 27001: Requirements for an Information Security Management System. Certifiable.
ISO/IEC 27002: Implementation guidance for information security controls.
ISO/IEC 27005: Guidelines for managing information security risks.
NIST CSF 2.0: Cybersecurity framework organized into six functions, from Govern to Recover.
NIST RMF: Risk management framework with a cycle for selecting, assessing and authorizing controls.
CIS Controls v8: Controls prioritized by implementation group, with measurable safeguards.
SOC 2: Independent audit report on the Trust Services Criteria.