Information security · ISO/IEC 27001
vCISO, your external information security lead.
Someone who takes charge of your company’s information security: organizes the risks, sets priorities and reports to management. Part-time.
When you need it
When someone starts asking you about security.
A customer sends you a security questionnaire
Or requires ISO/IEC 27001 in the contract.
Your insurer asks for minimum controls
Two-factor authentication, backups, access control.
Your company handles personal data
Argentina’s Law 25,326 requires you to protect it.
What it includes
What ISO/IEC 27001 asks for, sustained month after month.
Risk analysis
Which information is critical and what can go wrong.
Policy and documentation
Clear rules and tailored records, without unnecessary binders.
ISO/IEC 27001 controls
Which ones apply, each with an owner and evidence.
Customer questionnaires
We answer them with your team, with the evidence in order.
Reporting to management
Risks, progress and pending decisions, in business language.
Awareness
To spot a phishing attempt and know whom to tell.
Who does what
Everyone in their place, so no one checks their own work.
Decides
Management
Approves the policy and how much risk it accepts.
Governs
The vCISOUs
Analyzes risks, builds the plan, coordinates and reports.
Operates
IT or your provider
Configures and runs the technology.
Checks
Internal audit
Trained people from your team, or our consultants, other than the ones who advise you.
Certifies
Certification body
If you decide to certify, it audits and issues the certificate.
Why we do not certify. Certification is granted by an independent body, never by the consultant. Internal audits, on the other hand, can be outsourced to us: they are done by consultants other than the ones advising you.
What it does not include. Penetration testing, 24/7 monitoring or technical incident response: the vCISO governs, it does not operate.
How it works
Assessment first, ongoing support after.
Initial assessment
We look at how information is handled today and what is being asked of you. You get a plan with priorities.
Monthly support
A few hours a month, based on what the assessment shows. Reviewed with management.
Common questions
Frequently asked questions
How is it different from an in-house CISO?
The role is the same; what changes is what the organization pays for the management. We provide the service so you do not need to hire a CISO (Chief Information Security Officer) as a salaried employee.
How many hours a month does it take?
It is defined in the assessment, based on the size of the company and what customers, insurers or the law require.
Do I need to get ISO/IEC 27001 certified?
No. It is the working framework. If a contract requires certification, the work aims at that audit.
Can you train our internal auditors?
Yes, with the ISO/IEC 27001 internal auditor course (taught in Spanish).
Contact
Tell us what you are being asked for.
With that, we will arrange a first conversation.