Services
Engagements are flexible: fractional/vCISO, program leadership, specific compliance workstreams, or audit preparation.
Information Security Governance & CISO Support
- Security strategy and roadmap aligned to business objectives.
- Policies, standards & internal controls (ISP/PSSI) with clear ownership (RACI).
- Risk analyses (ISO 27005) and prioritized action plans with budgets.
- Program governance: cadence, steering committees, KPIs/KRIs and board packs.
- Security awareness tailored to business & IT audiences.
Compliance: PCI DSS · ISO 27001 · GDPR · DORA · NIS2
- Support for BUILD (initial implementation) and RUN (continuous compliance).
- Audit & certification readiness, evidence production and issue closure.
- Control testing & automation; continuous improvement of compliance posture.
- Security by design gates in the SDLC and change management.
- Risk register, heatmap and treatment tracking kept up to date.
Third‑Party Risk (TPRM)
- Supplier due diligence & audits; Security Assurance Plan (PAS) requirements.
- DORA‑aligned critical supplier oversight and concentration risk view.
- Contract clauses, SLAs and remediation follow‑up.
Resilience (Cyber & Operational)
- BCM/ISO 22301: BIA, criticality, dependencies, RTO/RPO, MTPD.
- BCP/DRP design with playbooks; recovery runbooks and exercises.
- IT DR strategy: on‑prem/cloud, 3‑2‑1‑1‑0 backups, vault, segmentation, failover/failback tests.
30/60/90‑day Approach
Days 0‑30 — Understand & Stabilize
- Kick‑off, stakeholder map, program charter & governance cadence.
- Rapid baseline of risk & compliance; immediate gap remediation.
- Define KPIs/KRIs and a one‑page executive dashboard.
Days 31‑60 — Build & Prove
- Policies, standards, control framework; RACI and ownership embedded.
- Initial control tests; audit file preparation and evidence collection.
- Launch TPRM and security‑by‑design gates in the delivery lifecycle.
Days 61‑90 — Scale & Embed
- Roadmap execution with measurable outcomes; burn‑down of risks and issues.
- Training & awareness; handover to internal teams or continued vCISO.
- Quarterly board report and next‑quarter OKRs.
Engagement Models
Fractional vCISO
Part‑time leadership with clear outcomes and steady cadence.
- Monthly governance cadence & board reporting.
- Ownership of roadmap and risk register.
- Ideal for scale‑ups or mid‑market regulated entities.
Program Acceleration (12 weeks)
Jump‑start or rescue a GRC program and reach audit‑ready status.
- Baseline, plan, quick‑wins and control implementation.
- Evidence pack and audit playbook.
Audit Readiness Sprint
PCI DSS or ISO 27001 focused sprint before assessments.
- Gap list, owners, dates; evidence collection.
- Mock interviews and auditor Q&A preparation.
On‑Demand Advisory
Targeted support for deals, due diligence, incident post‑mortems, or policy refresh.
Why RRSG
Regulatory fluency across EU frameworks (NIS2, DORA, GDPR) and industry standards (ISO 27001, PCI DSS).
Speed to value with a disciplined 30/60/90 plan and stakeholder‑friendly deliverables.
Executive reporting that is concise, visual and decision‑oriented.
Pragmatic documentation and control evidence tailored to your auditors and regulators.
Multilingual support (EN/ES/FR) and cross‑border experience (MX/FR/DE/ES).
Security & Resilience integrated: GRC, TPRM, BCM/DR in one program.
Contact
Let’s discuss your priorities. We usually respond within one business day.