Building practical security programmes that work for your business. Implementing the right policies, controls and assurance processes without unnecessary complexity.
What we do
You have security concerns and need to know what to tackle first.
ISO 27001, NIST CSF and CIS Controls assessments, with clear recommendations on what to improve and guidance that helps turn findings into practical next steps.
Your policies need to reflect how people actually work.
Policy, standards and control mapping for audits, customer reviews and day-to-day delivery.
You know what needs improving and need help putting it into practice.
Practical programmes for security awareness, third-party risk, supplier assurance and embedding security into everyday operations.
You need someone to help make decisions and keep the work moving.
Fractional CISO support to set priorities, manage risk and provide ongoing direction as your security programme develops.Who you will work with
25+ years in information security, with a career that includes senior roles at global technology companies.
Engagements
A fixed-scope review of your programme, policies or a specific capability, ending in findings and a practical roadmap.
Put a specific security capability in place and leave with something your business can use.
A defined piece of work such as a policy framework, security awareness programme, third-party risk process or certification readiness assessment.Fractional security leadership arrangement. A small, predictable monthly commitment on an ongoing basis that provides consistent strategic guidance to keep security priorities on track and provides a trusted point of contact.
How we work
Understand what you depend on, what could disrupt it and where improvements would make the biggest difference.
A policy should help someone make a decision. An improvement plan should fit the time, skills and resources your team has.
Agree what needs to be done, who will do it and how you will check progress.
My advice is independent. I do not resell software or have a commercial interest in your buying decisions.
Practical guidance
Practical advice for reviewing your programme, making policies work and setting security priorities.
Get the right people, scope and evidence together before the review begins.
Turn security requirements into clear rules that fit the way people work.
Understand the business, choose priorities and agree who will move the work forward.
Copyright and permitted use: https://kurosec.io/copyright