Cyber Care: Information Security Officer

Who it’s for

• organisations that need a person responsible for information security but don’t have one on staff
• boards to which NIS2 has shifted direct responsibility for cybersecurity
• entities with an ISMS in place that lack someone to run it

With the NIS2 Directive coming into force, responsibility for cybersecurity has moved directly to board level. The Information Security Officer service provides the board with strategic support in cybersecurity, regulatory compliance and digital risk management.

What it includes

• day-to-day coordination of the staff designated in the ISMS,
• planning and coordinating training, tests and other external activities,
• conducting internal audits,
• reporting to the board.

Main functions

Coordinating and overseeing ISMS maintenance

• coordinating the work of the information security team,
• overseeing staff activities in line with the ISMS,
• briefings on ISMS procedures,
• responding to questions and information security event reports,
• checking evidence that ISMS procedures are followed (registers, notes).

Ensuring regulatory compliance

• analysing the legal and regulatory landscape,
• recommending and coordinating necessary changes to the ISMS.

Building resilience

• planning training and awareness-raising activities,
• planning and conducting internal audits and management reviews,
• coordinating ISMS improvement and updates,
• overseeing supply chain security, advising on contract clauses,
• taking part in external audits.

Incident management

• categorising security events, identifying incidents,
• coordinating incident response and remediation,
• coordinating legal and reputational actions,
• reporting incidents to external institutions,
• representing the organisation in dealings with external institutions.

Support for the board

• reporting on cybersecurity status and events,
• translating cyber risk into business language,
• recommending actions that increase resilience,
• cyber governance training for the board,
• preparing incident response scenarios.

What you get

• full control over your level of cybersecurity
• regulatory compliance
• protecting board members from legal liability
• greater trust from customers and partners