Managed security

Fractional CISO on a monthly retainer. After the certificate, or instead of a first security hire. Cancel anytime.

What the retainer covers

• The annual cycle: the ISO 27001 surveillance audit, the next SOC 2 observation window and fieldwork, the yearly penetration test, the risk assessment and the management review, on a calendar you can see.
• Security questionnaires, vendor risk assessments and the call with the customer's security team, answered from the evidence the programme already holds.
• Vendor reviews, data processing agreements and the sub-processor list, kept current as the product adds services.
• Incident lead when something happens: the decisions, the customer notification, the post-incident report, the regulator if one is owed a notice.
• Policy upkeep, onboarding and offboarding checks, access reviews, and the evidence for each of them in your automation platform.
• Board and investor reporting: the risk register, the open items, and what they cost to close, in one page a quarter.
• Data protection officer duties under GDPR where the company needs a named DPO.

How it runs

A fixed number of days a month, a written monthly report, a reply within one business day and same day when a deal is waiting. Bigger pieces of work are quoted separately. It ends with a month's notice when you hire.

Most retainers start when the certificate is issued and the yearly cycle needs an owner.