Services
Information Security
& External CISO
We help you manage information security without building your own security team – from setting the rules and managing risks to regular oversight and training.
Small and medium-sized companies today face cyber risks, customer requirements and obligations arising from the Czech Cybersecurity Act. Yet they often have no information security specialist of their own. We take on the role of an external CISO to an extent that matches the size and needs of the company, and set up security according to the relevant requirements, standards and good practice – such as the Czech Cybersecurity Act (NIS2) or ISO/IEC 27000.
When to contact us
- You fall within the scope of the Czech Cybersecurity Act
- Customers or tenders require ISO/IEC 27001
- You have no information security specialist of your own
- You want independent oversight of an external IT provider
- You need to find out where your security weaknesses are
- After an incident, you want to set up better prevention
- You need security rules and processes put in place
- You want practical training for management or employees
How we help with security
We set up security
We set up information security according to the needs of your company and the relevant requirements – such as the Czech Cybersecurity Act or the ISO/IEC 27000 family of standards.
External CISO
We continuously monitor the state of security, assess risks, coordinate measures and oversee the work of suppliers. We keep management regularly informed about the situation and priorities.
We train your people
Our training is practical, built on examples from real incidents and forensic casework. We tailor the content to management, IT and everyday users.
Security training
People are an important part of information security. We train in person and online, from short sessions for management to regular programmes for the whole company. We build on real cases and show employees how to recognise risky situations and respond to them correctly.
From our casework
A medium-sized company had outsourced IT administration, but no one was managing information security over the long term. There was no overview of how employees handled sensitive data, where they transferred it and where the greatest risks arose.
We first assessed the state of the environment and set priorities. The measures also included deploying specialised software for better visibility of sensitive data movements and risky user behaviour. Based on the findings, we adjusted the rules, responsibilities and technical measures and set up regular reporting to management.
Today we act as the client’s external CISO, continuously evaluating risks and adjusting the measures as needed.
Frequently asked questions
What exactly does an external CISO do?
An external CISO manages information security much like an in-house security manager. They continuously assess risks, propose and coordinate measures, oversee suppliers and keep management regularly informed about the state of security and the priorities.
Is an external CISO suitable for a smaller company?
Yes. It is precisely smaller companies that often do not need a full-time security specialist. We scale the service to the size of the company, its risks and its requirements – from a few consulting hours to regular long-term cooperation.
We have an external IT provider. How will you work together?
An external CISO does not replace IT administration. The IT provider runs the systems and delivers the technical solutions; we manage security independently, set the requirements and verify that they are met. We work directly with your IT provider on implementing the necessary measures.
Can you help us with the Czech Cybersecurity Act?
Yes. We help determine which requirements apply to your organisation, assess the current state and propose the necessary measures. We can then help with implementing them and maintaining them over the long term.
Can you help us prepare for ISO/IEC 27001?
Yes. We help introduce or adjust an information security management system (ISMS), prepare the necessary documentation and remove shortcomings before the certification audit. The certificate itself is issued by an independent accredited certification body.
How extensive does the cooperation usually need to be?
It depends on the size of the company, the current state of security and the goals of the cooperation. The scope tends to be larger at the start because of the initial assessment and priority setting; afterwards it may come down to a few hours a month devoted to regular oversight, coordination and reporting.
Marián Svetlík jr.
lead consultant
The first consultation is free and confidential.
Related
Not sure whether this is a case for us?
Call us – the first consultation is free, confidential and comes with no obligation.