IT and information security for companies with 10 to 500 employees
Your systems grew or were outsourced. The knowledge is scattered, and nobody can measure the state. That is arithmetic, not a failure. We measure the state, fix what carries the biggest risk first, and deliver the evidence before anyone asks.
If a customer requires ISO 27001
In most cases you do not need the certificate right away. The risk team has to be able to document a risk.
Exception: with a knock-out criterion in a tender, with a public-sector buyer, or as a DORA-critical supplier, the scope often requires the passed certificate. The roadmap.
If a questionnaire is on your desk
If a customer or your cyber insurer has sent you a security questionnaire, we fill it in as part of the assessment. No separate product, no extra invoice.
Triggers
Seven triggers, one root. Every one of our mandates has started in the same place.
The first step
A control point is a fixed, surveyed reference. From it you map unknown terrain. That is exactly what the assessment is: the fixed reference point in an IT estate that has grown.
7,500 to
12,000 euros
No framework agreement, no automatic renewal. What comes next is your decision.
The price follows your system landscape, not your headcount: a grown on-prem estate with two to three interviews costs 7,500 euros, several large cloud environments cost around 12,000 euros. Buy the ISO roadmap and the assessment is included. You do not pay for it twice.
The market is split, we are not. Good security is good IT. What to do gets decided only once someone knows what is actually there.
We lead the conversations with the risk team, from day one and for as long as it takes. The roadmap.
Honesty
We are not the right people. Call your cyber insurer. They have an incident response provider on file. Come back once the forensic report is in your hands. Bring it, the assessment builds on it. You can also reach out while the forensics are still running; we then plan what follows. After that the rebuild starts: put access in order, get detection running, make the state provable. That is exactly what we did after a phishing incident, the case is here.
No incident response, no forensics, not even brokered.
We do not talk to your board without you.
The plan carries your name. You present it, we sit in the back.
You can stop after the first phase.
The findings go to you first. You read the draft before anyone else sees it.
Five engagements are documented as cases below, actually run and not invented. Every one began with an assessment. Which route it becomes is settled at the end of the assessment, not before it. The whole way to the ISO certificate: roadmap 15,000 to 25,000 euros plus ISMS 40,000 to 80,000 euros, which makes 55,000 to 105,000 euros. The assessment is included in the roadmap. You choose the certification body yourself and pay it directly. The cases.
Cases
The assessment
A trading company
No ISMS, and a major customer with a deadline.
After three weeks a strategy with a solid timeline was on the table, and the customer accepted it. The pressure was off.
Out of it: the ISMS in eight months, a GRC platform set up, then vCISO on a mandate.
A fund-owned company
The IT had grown, no governance, no documentation.
Out of it: the IT estate documented, consolidated, migrated from on-premise to the cloud, two acquisitions technically integrated, governance put in place (IAM, HR system).
A fintech
Regulated, but no view of attacks inside its own house, an ISMS only on paper.
Out of it: managed detection, EDR across the estate, ISMS consulting, and a penetration test at the end.
An insurer
The ISMS was in place, but their own IT could not run the standards.
Out of it: a cryptography standard and a logging concept their own team understands and can run.
A software company
After an incident: accounts taken over through phishing, no detection in the house.
Out of it: access put in order, MDR and EDR rolled out, an ISMS set up. Today the operation sees an attack.
Thirty minutes with one of our clients, in confidence.
We do not name our customers publicly. Names and references are on the table in the first conversation.
We work with a stack we know in depth: Microsoft Security, Cloudflare, Zscaler, Tailscale, Azure, Google Cloud and Workspace. If a different tool fits your landscape better, we recommend it, even when we do not supply it. We name our partnerships openly, so you can judge what we recommend.
For the SOC we select and set up. The operation goes to a provider who can do that around the clock. We do not claim to do it on the side.
We are a fixed circle of certified specialists for network, cloud, Microsoft Security, identity and GRC, plus partners for offensive security. The founder is Lead Implementer for ISO 27001 (PECB), with certifications across the circle for AWS, Azure and Google Cloud.
We introduce the people involved by name in the first conversation.
The founder
I built the systems before I governed them. That is what sets me apart from a consultant who only writes controls down.
Tomislav Ljubas
Twelve years in corporate IT at a listed group: started as a data engineer, then IT compliance, then IT architecture, up to leading corporate IT and security. Five of those years, 2018 to 2023, as CISO, alongside the line role.