Other cookies are configurable.
Protect what your organisation runs on: its information.
Confidentiality, integrity and availability, protected not by a shelf of policies but by a living information security management system: risk driven, proportionate and aligned to ISO 27001.
What is information security consulting?
Information security consulting establishes the management system that protects an organisation's information across three properties: confidentiality, so only the right people see it; integrity, so it remains accurate and untampered; and availability, so it is there when the business needs it, structured as an ISMS aligned to ISO 27001.
Security fails in practice when it is treated as an IT purchase rather than a management discipline. An effective ISMS starts from the information assets that matter and the risks to them, selects controls proportionate to those risks, embeds ownership and operation into the business, and reviews and improves on a cycle, exactly the loop certifiers audit and regulators increasingly expect to see.
We design and implement that system end to end: asset and risk identification, control selection and the Statement of Applicability, policy and process development, awareness across the workforce, internal audit, and preparation for ISO 27001 certification where that is the objective. Because the same practice builds continuity and cyber resilience, your ISMS lands connected to incident response and recovery rather than beside them.
From asset register to certifiable system
Frequently asked questions
What is an ISMS?+
An information security management system: the ISO 27001 defined structure of governance, risk assessment, controls, operation and review through which an organisation protects the confidentiality, integrity and availability of its information continuously, rather than through one off projects.
How does information security relate to cyber resilience?+
Information security protects the assets; cyber resilience keeps the organisation running when protection fails. They share the same risk picture and should be built together, which is how our cyber resilience practice and this service are designed.
Do we need ISO 27001 certification?+
It depends on who needs to trust you. Certification is increasingly demanded in tenders, supply chains and regulated sectors; elsewhere an aligned ISMS without the certificate can be proportionate. We build to the objective you choose.
How does this support NIS2 and the Swiss ISG?+
Directly. NIS2 Article 21 measures map closely onto ISO 27001 controls, and Swiss critical infrastructure operators under the ISG need exactly the incident detection and handling discipline an ISMS institutionalises. One system, several regulators satisfied.
How long does ISO 27001 implementation take?+
Typically several months from scoping to certification readiness depending on size, existing maturity and scope. We phase delivery so the highest risk assets are protected first and the certificate follows the capability, not the other way round.
Related services
Cyber Resilience
Beyond prevention: the capacity to withstand, respond and recover while essential services keep running.
Supply Chain Security
The risk you inherit from suppliers and shared platforms: mapped, assured, contracted and exercised, per ISO 28000, NIS2 and DORA.
NIS2 Compliance
From scope determination to Article 21 measures and 24 hour reporting readiness under Directive (EU) 2022/2555.
DORA Compliance
The five pillars of Regulation (EU) 2022/2554 implemented for financial entities and their critical ICT providers.
Risk Management
From risk universe to governed risk: identification, stress aware assessment, owned treatment and live monitoring.
Business Continuity Management
BIA, ISO 22301 aligned strategy, plans and validation: a continuity programme built to survive contact with a real disruption.
Organisational Resilience
The structure above the plans: risk, continuity, crisis, cyber and people on one governed foundation, per ISO 22316.
AI Governance and Resilience
Governance wrapped around every layer of intelligent systems, from model behaviour to board accountability and ISO 42001.
Crisis Management
Doctrine, structures and communications that contain the peak and shorten the recovery, anchored on ISO 22361.
Business Continuity Exercises
Tabletop, functional, cyber and full scale exercises that prove the plans and evidence ISO 22301, NIS2 and DORA.
7A Risk Management Framework
Our proprietary decision centric operating model: exposure and decision confidence measured separately, for the board.
DAEDALUS Airport Resilience Framework
The Airport Resilience Framework: five domains as one operating model across the aerodrome, powered by the 7A engine, in commercial, freight and business aviation editions.
Make security a system, not a stack of PDFs.
Ask us for an ISMS gap assessment against ISO 27001; you will know your distance to certifiable in weeks.
Book a consultation