Skip to content

Information Security & Cybersecurity

Security programmes and ISMS for technology and regulated businesses, built and run so you can evidence your controls to customers, auditors and regulators.

Discuss your matter

Typical deliverables

  • Gap analysis and prioritised remediation roadmap
  • Security policies and procedures teams can follow
  • ISMS scope, risk register and Statement of Applicability
  • Business continuity, disaster recovery and incident response plans
  • Reusable customer security assurance pack
  • Audit evidence and findings tracker

A cross-jurisdiction capability, supported across the jurisdictions in our directory. See jurisdictions

Overview

Why it matters

For a technology or regulated business, security is now part of how it sells, raises capital and meets its regulatory obligations: enterprise customers review a supplier's controls before they sign, regulators set requirements through DORA, NIS2 and sector rules, and certification bodies, banks, payment partners and investors ask for evidence that those controls work.

We work on both sides of that question: advising on what the business needs, and helping to build it. We assess where the gaps are, design a programme that fits the size and risk of the business, implement the governance, policies and controls, and prepare the organisation — and its evidence — for auditors, customers and regulators, so each review draws on evidence you already hold.

Where a business needs security leadership but not yet a full-time CISO, we take on that role in a fractional capacity, so that strategy, implementation and day-to-day ownership stay with one team.

We build security programmes alongside our Privacy & Data Protection and AI Governance practices, so that one set of controls and evidence serves security, privacy and AI governance.

Our work is the governance, risk, compliance, programme and assurance side of security. Penetration testing, security operations, managed detection and the engineering of technical controls are carried out by specialist providers, not by ROZSUD; we define what your framework or regulation requires of that work, help you select providers and review the results, so it feeds your programme and your audit evidence.

Key services

From the first gap analysis to the external audit

We identify the gaps, design the programme, help implement it and support you through review by auditors, enterprise customers and regulators, with the evidence each expects.

Fractional CISO / External DPO

Senior security and privacy leadership on an agreed monthly scope, for businesses that need a CISO or a DPO without the cost of a full-time internal function.

  • Strategic planning, gap identification and a remediation roadmap
  • Programme governance, policy architecture and risk oversight
  • Vendor risk, incident preparedness and awareness training
  • Guidance for internal teams, and reporting to management
  • Support with customer security reviews and audit preparation

A CISO and a DPO are different roles. A CISO leads the security programme; a DPO carries out the tasks the law assigns to the role — monitoring compliance, advising on impact assessments and acting as the contact point for the supervisory authority — and acts independently. As your external DPO, we take on those tasks under a service contract.

Certification & External Audit Support

Support through the whole readiness and audit process — for ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification, SOC 2 examinations and other external audits — from the first gap analysis to closing the findings.

  • Building or refining the framework the audit will test
  • Gap analysis against the standard or criteria
  • Policies, procedures, registers and evidence prepared for review
  • Teams prepared for auditor interviews
  • Evidence gathering coordinated across the business
  • Acting as your coordination point with the external auditor, including in audit sessions
  • Remediation of audit findings

Certification and attestation decisions rest with the independent certification or audit body; ROZSUD is not a certification body and does not issue certifications. Our role is to have you ready for that review.

Enterprise Sales & Customer Assurance

Security, privacy and, increasingly, AI reviews are a routine step in enterprise procurement. We help you respond accurately and quickly, so your answers keep pace with the deal — removing security and privacy blockers without overstating the controls behind them.

  • Customer security and privacy questionnaires
  • RFIs and the security sections of RFPs
  • Vendor due diligence and security reviews
  • Enterprise procurement and contractual security requirements
  • Customer audit requests
  • A reusable assurance pack of policies, summaries and evidence

Third-Party Security & Privacy Due Diligence

An independent assessment of a vendor, partner, investee, acquisition target or other strategic counterparty, so you know the risks before you rely on it or invest in it.

  • Scope agreed around the relationship and the risk it carries
  • Document review, interviews and evidence sampling
  • A structured report of control gaps, material risks and compliance concerns, with remediation recommendations you can act on

This is a security and privacy assessment, not a statutory financial audit.

Scope

What we do

Programme & governance

  • Fractional CISO Support

    Security leadership for businesses that need a CISO's direction before, or instead of, a full-time hire.

  • Security Programme Design & Implementation

    An information-security programme sized to the business, with clear ownership, priorities and a roadmap that product and engineering teams can follow.

  • ISMS Design, Implementation & Improvement

    An information security management system built to ISO/IEC 27001, or strengthened ahead of surveillance and recertification audits.

  • Gap Analysis & Remediation Roadmaps

    Assessment against the framework or regulation that applies, with gaps ranked by risk and a remediation plan with owners and dates.

  • Security Governance & Control Frameworks

    Policy architecture, roles and responsibilities, management oversight, and a control framework mapped to the standards you need.

  • Security Awareness & Role-Based Training

    Awareness programmes for all staff, and role-based training for engineers, administrators, managers and the board.

Risk & resilience

  • Cyber Risk Management

    A risk methodology, risk register and treatment plans that connect technical findings to business decisions.

  • Third-Party & Vendor Risk Management

    Due diligence, contractual security requirements, registers and ongoing oversight of critical suppliers, including ICT providers.

  • Business Continuity Planning

    Business impact analysis, continuity strategies and plans, aligned with ISO 22301 where certification or customers require it.

  • Disaster Recovery

    Recovery objectives, recovery plans and the testing that shows whether they work.

  • Incident Response Governance & Readiness

    Incident response plans, escalation and decision rights, regulatory notification workflows, and exercises that test them.

Assurance & audit

  • Certification & External Audit Readiness

    Preparation for ISO/IEC 27001 certification, SOC 2 examinations and other external audits, through to closing the findings.

  • Internal Control Testing & Internal Audit Support

    Testing whether controls operate as designed, and support for internal audit programmes and management reviews.

  • Enterprise Customer Security Assurance

    Security questionnaires, RFIs, customer due diligence and security reviews answered accurately and consistently, in step with the enterprise sales process.

  • Security Due Diligence & Third-Party Assessments

    Independent security assessment of vendors, partners, investees and acquisition targets, before you sign or invest.

Regulatory requirements

  • DORA Compliance

    ICT risk management framework, incident classification and reporting, resilience testing governance and ICT third-party risk for EU financial entities.

  • NIS2 Compliance

    Whether NIS2 applies, registration where national law requires it, risk-management measures and incident reporting under the national transposing law.

  • Technology Regulatory Compliance

    Regulatory review of technology arrangements — cloud outsourcing, platform changes and new products — before they go live.

Frameworks

Frameworks, standards & regulations

Standards and frameworks are chosen — to certify against, to report on or to give a programme its structure. Regulations and legislation apply by law, according to where the business operates and what it does. We work with both, mapping one set of controls to the requirements that apply, so you can run and evidence one programme rather than several.

Standards

ISO/IEC 27001
Information security management systems (ISMS): the requirements, and the basis for certification.
ISO/IEC 27017
Information security controls for cloud services, for providers and their customers.
ISO/IEC 27018
Protection of personal data (PII) in public clouds acting as PII processors.
ISO 22301
Business continuity management systems.
PCI DSS
Payment Card Industry Data Security Standard, for businesses that store, process or transmit cardholder data.

Frameworks

SOC 2
System and Organization Controls 2: attestation reports issued by independent CPA firms against the AICPA Trust Services Criteria.
NIST Cybersecurity Framework
NIST CSF 2.0 and related NIST security publications, such as SP 800-53, used to structure and benchmark security programmes.

Regulations & legislation

NIS2
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, as transposed into national law.
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554, for EU financial entities and their ICT third-party providers.

Working with us

Engagement formats

Every engagement is scoped in writing before work begins, in one of these formats or a combination of them.

  • Focused advisory session

    A prepared consultation on a defined security, privacy or AI-governance question, followed by practical action points.

  • Scoped deliverable

    Preparation, review or improvement of a specific policy, procedure, assessment, register, methodology or other governance deliverable.

  • Fractional support

    Ongoing senior security, privacy or AI-governance support under an agreed monthly scope.

  • Programme build or remediation

    Building or improving an ISMS, PIMS, AIMS or broader compliance programme against an agreed framework.

  • Audit & customer assurance support

    Preparation for certification audits, customer audits and enterprise security or privacy reviews, and the remediation that follows.

  • Third-party assurance

    Independent security and privacy assessment of a vendor, partner, investee, acquisition target or other third party, with findings and recommendations.

We set out the timetable for our work in the written scope before it starts. It reflects the size of the organisation, its current maturity, its product and geography, the framework selected and the scope of any audit; the certification date itself follows the audit.

Jurisdictions

Supported across jurisdictions

We support Information Security & Cybersecurity across the jurisdictions in our directory, adapting the work to what each jurisdiction's law requires and coordinating local specialists where local law, registration, representation or professional requirements require it.

Cartography by ROZSUD from Natural Earth data (public domain).
Europe18
Asia & Middle East4
Americas & Caribbean11
Africa & Indian Ocean6

Industries

Where we apply it

Questions

Frequently asked

Do you carry out penetration tests or security monitoring?

No — specialist providers carry out penetration testing, security monitoring and technical engineering. We lead the governance, risk, compliance and assurance side and help implement it: we specify what your framework or regulation requires of that work, help you choose providers and review the results.

Can you get us certified to ISO/IEC 27001?

The certification decision rests with the independent, accredited certification body. Our work is to prepare you for the audit and see it through: building or refining the ISMS and its evidence, acting as your coordination point with the auditor and closing any findings.

What does a fractional CISO do?

A fractional CISO sets the programme's direction, owns the roadmap, oversees risk and vendors, reports to management and supports customer and audit reviews, so security has an accountable senior owner and management a clear view of risk.

Does DORA apply to us?

DORA applies to a defined list of EU financial entities — including payment and e-money institutions, investment firms and crypto-asset service providers — and reaches their ICT providers through contractual requirements; providers designated as critical are also overseen directly by the European Supervisory Authorities. We confirm applicability and scope first, so the gap assessment covers what DORA requires of you.

Related

Related practice areas

  • Privacy & Data Protection

    External DPO services and working privacy programmes: GDPR and global privacy laws, DPIAs, data mapping, transfers and ISO/IEC 27701.

  • AI Governance

    Governance that lets AI adoption scale: EU AI Act readiness, ISO/IEC 42001 management systems, AI risk and impact assessments, and vendor risk.

  • Commercial & Technology Contracts

    Platform, white-label, B2B supply, SaaS, affiliate and outsourcing agreements, drafted and negotiated to close deals in regulated markets.

  • Regulatory & Licensing

    Licence strategy, applications and regulator engagement for gaming, payments, e-money, investment and crypto-asset businesses.

All practice areas

Preparing for ISO/IEC 27001, a customer security review or DORA?

Tell us what is driving the work. We discuss where your security programme stands and what to prioritise, then send a written proposal with scope, timetable and fee.

Request a consultation