Is an information security officer required?

No law requires a role with exactly this name in general. But ISO/IEC 27001 asks for clear roles in information security. The German BSI IT-Grundschutz explicitly calls for an information security officer. NIS2, critical infrastructure rules and many customers also expect a named person. In practice, you almost always need the role.

Internal or external ISO: which fits better?

An internal ISO knows your processes and people. An external ISO brings experience from many projects. They are independent of internal interests and can start right away. For many mid-sized firms, this is the faster and more predictable choice. That is especially true when you have no in-house expert.

Can the head of IT also be the ISO?

We advise against it. The ISO should assess IT operations independently. Someone who also runs operations ends up reviewing their own work. An external ISO avoids this conflict of interest.

What is the difference between an ISO and a CISO?

Both are in charge of information security. Larger firms tend to say CISO. They mean a leadership role with its own team and budget. ISO (in German: ISB) is the usual term in German-speaking countries and in BSI IT-Grundschutz. We take on both roles externally.

How much does an external ISO cost?

That depends on your size, sector and the scope you need. We start with a free first call. Then you get an offer that clearly describes the scope.

IT Security Management Systems

External CISO

An External ISO forYour Business

Attacks on companies keep rising. Customers, insurers and lawmakers want to know who is in charge of security at your company. An external ISO takes on this role. You do not need to create a new position.

Request CISO Service

What an External ISO Does

Risk analysis and rating
Writing security policies
Putting safeguards in place
Staff training and awareness
Compliance checks
Handling and managing incidents

What Are the Benefits of an External ISO?

More and more firms choose an external security officer. You stay flexible and keep costs in check. You get an independent view. And you gain access to a network of experts.

Flexibility & Cost

You get help when you need it, with no need to hire someone full-time. You pay only for the work done, with no extra staff costs.

Expertise & Experience

You gain broad know-how from many industries. You also get access to a network of experts and to specialist resources.

Independence & Objectivity

You get a fair and neutral view of your security. No in-house politics or conflicts of interest get in the way.

Fast Response

Our ISOs are quick to reach and quick to act on security incidents. As your sparring partner, they stay in close touch with your company.

Compliance & Regulation

Whether NIS2, critical infrastructure rules or ISO 27001: we keep track of what is required. We prepare proof for regulators, auditors and customers.

Knowledge Transfer

We train your in-house teams and share what we know. Regular external audits and updates help you keep getting better.

When Do You Need an ISO?

Companies with highly sensitive data need an ISO most. The same goes for complex IT and for regulated sectors.

Sensitive Data

You process or store highly sensitive data or personal data

Complex IT

Your IT has many systems that are closely linked

Regulated Sector

You work in a regulated sector, such as critical infrastructure, banking or healthcare

After Incidents

You have had security incidents and need to get back on a solid footing

What does an information security officer do?

The information security officer (ISO) runs security in the company. They make sure risks are known and safeguards are put in place. Management gets an honest status report from them on a regular basis. In theISMS, the ISO ties everything together.

The final say stays with your management. The ISO gives advice and prepares decisions. They speak up when something is wrong. Larger companies often call this roleCISO.

Internal or external ISO?

Internal ISO

Knows your processes and people
Has to be hired, onboarded and trained
Can face a conflict of interest when also working in IT

External ISO

Available right away, no hiring needed
Experience from many sectors and audits
Free of in-house politics

Common questions about the external ISO

What does an information security officer do?: The information security officer (ISO) steers security in the company. They plan risk assessments and keep them on track. They write security policies and keep them current. They help roll out safeguards, train staff and report to management on a regular basis. When an incident happens, they are your contact and help handle it.
Is an information security officer required?: No law requires a role with exactly this name in general. But ISO/IEC 27001 asks for clear roles in information security. The German BSI IT-Grundschutz explicitly calls for an information security officer. NIS2, critical infrastructure rules and many customers also expect a named person. In practice, you almost always need the role.
Internal or external ISO: which fits better?: An internal ISO knows your processes and people. An external ISO brings experience from many projects. They are independent of internal interests and can start right away. For many mid-sized firms, this is the faster and more predictable choice. That is especially true when you have no in-house expert.
Can the head of IT also be the ISO?: We advise against it. The ISO should assess IT operations independently. Someone who also runs operations ends up reviewing their own work. An external ISO avoids this conflict of interest.
What is the difference between an ISO and a CISO?: Both are in charge of information security. Larger firms tend to say CISO. They mean a leadership role with its own team and budget. ISO (in German: ISB) is the usual term in German-speaking countries and in BSI IT-Grundschutz. We take on both roles externally.
How much does an external ISO cost?: That depends on your size, sector and the scope you need. We start with a free first call. Then you get an offer that clearly describes the scope.

Your External CISO Is Ready

Put our experience to work for you. We can be your external security officer.

Request CISO Service Now

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.