Consulting
Advisory that lives on in the platform
Every engagement lands in your KaitoSec workspace. Findings, decisions and evidence stay with you, and your team runs the system itself afterwards instead of calling in consultants for every audit.
What we do
Gap analysis
Where your information security stands today, and what to do first. You get a prioritised action plan.
- Review of documents and processes
- Interviews with IT, management and departments
- Prioritised action plan
ISMS implementation support
We build your information security management system with you, from scope to the first internal audit.
- Scope, risk assessment and statement of applicability
- Core policies and responsibilities
- Internal audit and management review
Certification support
Targeted preparation for your ISO 27001 certification audit, including a mock audit, and support during the audit itself.
- Evidence check
- Mock audit and remediation
- Support during the certification audit
vCISO
Your external information security officer. The scope grows with your needs.
Internal audit
An independent review of your ISMS for conformity and effectiveness, as ISO 27001 requires.
NIS2 readiness check
Whether NIS2 applies to you, and what you have to do about it.
Resilience Café
A regular practitioner workshop for KaitoSec customers. You bring an open question and leave with a working answer.
- Your question, worked on live
- Notes and follow-ups land in your workspace
Management review
We run the management review ISO 27001 and ISO 22301 require together with you, inside your KaitoSec workspace, so inputs, decisions and actions stay on record.
- Audit findings, risks, incidents and KPIs as input
- Walk-through with management
- Decisions and actions logged in the platform
Training
Training for staff, admins and owners, remote or on site, tailored to your scope.
- All staff: the platform and awareness
- Security officers, admins and owners: running the management system
- Specialist topics and partners: standards and partner training
Consulting that makes you independent
Every analysis, decision and follow-up task is documented where your team will continue the work. The knowledge stays findable after the engagement, and responsibility passes to your organisation in a controlled way.
Consulting without platform
The outcome is a document. You organise what happens next separately.
- Recommended
Consulting plus platform
Outcome, owners and future reviews stay workable.
Platform without consulting
You operate on your own. Expert support joins only where you need it.
Scope
We are not a certification body. We prepare you for the certification audit and stand by you during it; the certificate itself comes from an accredited body such as TÜV or DQS.
What we do
- Gap analyses and risk assessments
- ISMS setup and policy writing
- Employee training and awareness
- Internal audit and mock audit
- Support during the certification audit
- Ongoing CISO advisory (vCISO)
- NIS2 readiness checks
What we don't do
- Certification audits
- Penetration testing and technical security testing
- Legal advice (we are happy to refer you)
- Data protection consulting as the main service (in cooperation, yes)
What should remain workable after the engagement?
We clarify the starting point, the internal owner and the smallest useful scope. Both sides then know whether consulting, platform or both fit.