Security Governance Advisory
Help with the decisions and structures around information security: who is responsible for what, how leadership stays informed, and how you answer customers who ask about it. The work ranges from a one-off review to a part-time security lead on a monthly arrangement.
Led by Levent Şakar, IRCA-certified ISO 27001 and ISO 9001 Lead Auditor.
Governance review and roadmap
A review of how information security is organised in your business today: roles and responsibilities, policies, how risk is reported to leadership and how suppliers are managed. You receive a practical roadmap that fits your size and commercial priorities.
| Reference frameworks | ISO/IEC 27001:2022, NCSC Cyber Assessment Framework |
|---|---|
| Typical timescale | About five days of work, usually completed within three to four weeks. |
| Fee | Fixed. |
Who it's for
- Organisations where security responsibilities have grown informally and need setting out clearly
- Leadership teams that want to understand where they stand before committing to certification
What you receive
- A written assessment of current arrangements
- A prioritised roadmap with owners and realistic timescales
- A walkthrough with leadership
vCISO
A part-time information security lead, on a fixed monthly arrangement. The role is governance-focused: keeping your management system working, advising leadership, and being the person your customers and auditors deal with on security and compliance matters.
| How it runs | An agreed number of days each month, with a fixed monthly fee and a defined scope. Minimum term six months, reviewed every quarter. |
|---|
Who it's for
- Organisations that need senior information security input but not a full-time hire
- Organisations that have achieved certification and need someone to keep it running
What it typically includes
- Keeping the risk register, Statement of Applicability and policies up to date
- Planning and coordinating internal audits and management reviews
- Supplier security assessments and responses to customer questionnaires
- Preparing for and attending surveillance and recertification audits
- Regular reporting to leadership
- Tracking regulatory and standard changes that affect you
What it doesn't include
- Day-to-day IT administration and technical incident response. Where those are needed, I work with your IT team or provider.
Security questionnaires and due diligence
Customers increasingly send security questionnaires and due diligence requests before awarding or renewing a contract. They take time to answer properly, and inconsistent answers can cause problems later. I help you respond accurately and build a set of answers you can reuse.
| Typical timescale | One to two days per questionnaire, less once an answer library is in place. |
|---|---|
| Fee | By the day. |
What it covers
- Completing customer security questionnaires and due diligence assessments with your team
- Making sure answers match your policies and what you actually do
- Building a reusable answer library and supporting evidence pack
Need security leadership without a full-time hire?
A short call is usually enough to work out which option fits.