CISO as a Service & Security Governance

One of our senior consultants takes charge of your security on a fractional basis: defining the information security policy, managing risk, regulatory compliance, awareness and leadership reporting. The format adapts to your needs, from a few days a month to a near-continuous presence.

An audit produces a report at a point in time. Our CISO as a Service approach is an ongoing engagement: we run your security roadmap over time, track risk indicators, coordinate remediation and report to leadership. It is the difference between a one-off checkup and a primary care physician.

We start with a gap analysis to measure the distance between your current posture and the regulatory requirements. Then we build a realistic compliance roadmap, with milestones and auditable evidence. The goal is to get there without a last-minute scramble.

No, that is exactly what CISO as a Service is for. We structure the governance and identify the internal champions to train. Over the course of the engagement, your teams build their skills and gain autonomy on security.

Our role is scoping and strategic oversight. For technical implementation work (pentests, SAST/DAST, tool configuration), we scope the need, select specialized providers and manage their work. You keep a single point of contact who coordinates everything.

The initial assessment takes 4 to 6 weeks. The CISO as a Service engagement then continues according to your needs, typically 6 to 12 months. The goal is to structure governance and make your teams autonomous, not to create dependency.

A fractional CISO (CISO as a Service) costs between €2,000 and €6,000 per month depending on the volume of work (2 to 8 days/month). That is as little as one-fifth the cost of a senior in-house CISO (€80–120K base salary plus payroll taxes). The format is flexible and adapts to the maturity of the organization. The first deliverables (information security policy, risk map) are produced in the very first month.

The NIS2 directive, adopted in 2022, is still being transposed into French law (the “Résilience” bill). Depending on the sector, it covers entities with 50+ employees or €10M+ in revenue in 18 critical sectors (energy, transport, health, digital, finance, water, food, etc.). Penalties can reach €10M or 2% of global revenue for essential entities, and €7M or 1.4% for important entities. If you supply an essential entity, you are also indirectly affected. We run a NIS2 assessment in 2 days to assess your situation.