Risk picture and security plan
We map the important assets, current threats and technical dependencies, and produce a workable plan.
03 / CISO as a Service
Security leadership
for the AI era.
An external security leader who leads and develops your security work in the AI era. We help you prioritise risk as AI changes how you build and work, and turn technical results into remediation and management decisions.
01A named security leader
02A clear mandate and responsibility
03Ongoing prioritisation and follow-up
This is what we drive
Security leadership with
technical grounding.
The engagement is shaped around your organisation. The following areas can form part of the shared security plan.
Remediation together with the teams
We gather the review results, help you prioritise remediation, and follow up who does what.
Technical decisions
We support decisions on architecture, permissions and security controls as you build or change your systems.
Suppliers and customer questions
We assess the security of important suppliers and help you handle customer requirements and answer security questions.
Incident readiness
We clarify roles, lines of contact and procedures, and plan exercises that strengthen readiness.
Reporting and governance
We give management a clear picture of risk, progress and the decisions needed. Relevant requirements become part of the security work.
The mandate, division of responsibility, availability and reporting lines are agreed. The customer is responsible for business decisions and for accepting residual risk. Incident readiness does not automatically mean round-the-clock staffed incident response.
Your deliverable
A security plan
that gets used.
You get a shared way of working to plan, deliver and follow up the security work.
- A shared current-state pictureA consolidated view of risk, work in progress and weaknesses that need to be prioritised.
- An action plan with ownersAgreed actions with owners and follow-up, adapted to the teams' capacity.
- Regular working meetingsRegular meetings with the teams involved and the decision-makers.
- Reporting to managementProgress over time, residual risk and the concrete decisions that need to be made.
- Frameworks and templatesA framework and ready-made templates (policies, procedures and decision documents) that make the security work structured and reusable, adapted to your organisation.
EXAMPLE / THE MONTH'S SECURITY WORKWhat needs
What needs
to happen next?
PRIORITISEWhich technical risks need to be handled first?
DRIVEDoes each action have an owner and a workable plan?
FOLLOW UPWhat is fixed, verified or still open?
DECIDEWhich risk or investment does management need to take a position on?
EXAMPLE WAY OF WORKING · ADAPTED TO YOUR ENGAGEMENT
How it works
Start with the right effort. Build continuity.
Understand the current state
We review the organisation, systems, risks and existing security initiatives.
Clarify the mandate
We agree on objectives, responsibility, time commitment, ways of collaborating and reporting.
Deliver the plan
We work with the teams, produce decision documents and follow up the agreed actions.
Adjust over time
We evaluate the results and adapt the plan to changes and new needs.
Good to know
Before your
first engagement.
Does the service fit if we already have a CISO?
Yes. The engagement can strengthen an existing function, for example with technical follow-up, a bounded security programme or temporary capacity.
Are code review and pen-test included?
They can be coordinated with the CISO engagement, but the scope and delivery are agreed separately so it is clear what is included.
How extensive does the engagement need to be?
It depends on the risk picture, size and objectives. We propose a bounded effort and a suitable scope for the ongoing work after the first review.
Is this an AI service or a person?
A named person leads the engagement. Tools and AI support can ease analysis and documentation, but they do not replace the judgement of the responsible security leader or the dialogue with you.
Do you cover requirements such as DORA and NIS2?
Yes. Compliance is woven into the security plan where it is relevant. We help you turn requirements from, for example, DORA (ICT risk, incident reporting and third-party risk), NIS2 and ISO 27001 into concrete priorities and follow-up. The named security leader stands behind the documentation that goes out in the CISO domain.
Take the next step
What do you need
help to drive?
Describe your current situation. We will discuss which kind of security leadership would do the most good.