DOZOR
Demo

Virtual CISO

We give your company an experienced head of information security without a full-time hire. They build the security programme, manage contractors and report to management on risks and protection on a regular schedule.

Discuss your taskAll services
Annual security roadmapSample roadmap
  1. Q1Risk assessment, security policy, system inventoryDone
  2. Q2Backups under the 3-2-1 rule, MFA for remote accessIn progress
  3. Q3Event monitoring, external perimeter penetration testPlanned
  4. Q4Response drills, preparation for an ISO/IEC 27001 auditPlanned

A report to management every quarter

What a vCISO does

Strategy
Assessment of the current state, business risks and an annual security roadmap.
Policies
Security policy and procedures for access, backup and incident handling.
Risk and compliance
A risk register and the requirements of the law of the Republic of Kazakhstan, ISO/IEC 27001 and industry standards.
Budget and contractors
Choosing security tools and contractors, overseeing their work and costs.
Reports
Clear reports for management and the board: what was done and which risks remain.

Photos: Igors Jefimovs, CC BY 3.0; Matti Blume, CC BY-SA 4.0; Samuel Zeller, CC0; Estormiz, CC0, Wikimedia Commons.

Formats

How we start

  1. 01

    Introduction

    Interviews with management and IT, a review of documents and infrastructure.

  2. 02

    Assessment

    A report on the current state of security and the main risks.

  3. 03

    Plan

    An annual roadmap with priorities and a budget.

  4. 04

    Delivery

    We run the projects in the plan, write documents and oversee contractors.

  5. 05

    Reporting

    We show management the progress on a regular schedule and revisit priorities.

What you get

  • A security strategy and roadmap agreed with management.
  • Policies and procedures written for your company.
  • A risk register and a plan to reduce the risks.
  • Regular reports for management.

Questions

Ask your own question
How is a vCISO different from a full-time head of security?

You get the experience of a head of security without the cost of a full-time position. The format suits a company that needs a head of security for part of the working week.

Do you take Kazakhstan’s regulators into account?

Yes. We follow the law of the Republic of Kazakhstan on informatization and on personal data and the requirements of industry regulators, and prepare the company for inspections.

Can we start with a one-off consultation?

Yes. The first consultation often shows whether you need the ongoing format or a project is enough.

Discuss your task

Describe the task and the timeline. We will reply, clarify the scope and propose a plan.

  1. Contract. We start with a contract and a non-disclosure agreement. The scope of work and the permissions are put in writing.
  2. Scope. Goals, systems, timing and emergency contacts are agreed before the work starts.
  3. Work. We keep you updated as the work goes and report critical findings at once.
  4. Report. We hand over a management report and a technical report with evidence and recommendations.

Or write to us: info@dozorsecurity.kz

Request: Virtual CISO