CISO ad interim

If you’ve got board responsibility for cyber security, typically a CIO or CFO, and you’ve decided you need a CISO, you might be interested in how Astra Consulting are helping clients of all shapes and sizes embed security leadership into their organizations. We can support you by providing highly skilled and experienced consultants to both act as an interim CISO while you recruit your permanent; and advise your new-in-post CISO to ensure that your security objectives are met during periods of transition.

Many organizations find themselves in the position of having to recruit a CISO. However, it can take up to 12 months to recruit and transition a CISO into a full-time permanent role, leaving a gap in an organizations ability to continue to manage security from a strategic and operational basis. To reduce this impact many organizations hire an interim CISO as a stop gap measure between permanent hires. An interim CISO can be added to the organization within days, enabling you to continue to manage security risks, security incidents and drive your existing security strategy and improvement program forward.

Astra Consulting have a proven track record in delivering interim CISO services. We provide experienced former CISO’s who able to operate at a senior level and get up to speed quickly. Their extensive security expertise will keep your security function operating, drive organizational change to achieve strategic objectives and support you in recruiting a permanent CISO. This model is true of other senior security leadership positions, such as Head of Information Security Governance or Director of Security Architecture. As with the role of CISO, Astra Consulting have demonstrable experience providing other interim services to meet our clients’ requirements.

CISO advisory

As a CISO it’s sometimes difficult to get access to the right level of expertise to support your goals, objectives and decision making or there simply isn’t the skilled resources available to deliver strategic complex tasks and projects in the timeframes required. Astra Consulting can help you accelerate and deliver strategic security initiatives by providing you with access to highly skilled and experienced former CISO’s and security professionals. Example areas where we can provide support in addition to our existing Strategy & Transformation and Governance, Risk and Compliance services include:

• Developing meaningful cyber security metrics and executive reporting
• Reviewing and prioritizing security roadmaps and budgets
• Insource and outsource decision making support
• Interview and candidate screening support

Governance, Risk & Compliance

Establish the foundations of your action-orientated information security program The foundation for any information security program is an effective Governance, Risk & Compliance (GRC) function. Astra Consulting action-orientated approach quickly builds an organizational view of risk and compliance and allows prioritized implementation and demonstrable value. We provide practical GRC consulting services that are focused on accelerating security improvement through:

• Defining an appropriate vision and achievable target for security
• Developing and implementing a pragmatic and actionable security controls framework
• Effective communication and responsive stakeholder support
• Efficient controls assessments to provide organization-wide visibility over compliance and risk
• Creating and maintaining prioritized improvement roadmaps
• Defining actionable remediation activities with clear ownership and accountability
• Expert analysis with rich reporting and dashboards to quantify progress and value for stakeholders
• Practical and focused risk assessments and management of exceptions
• Proportionate and consistent assessment processes for secure-by-design for projects and supplier assurance

We can support you along any part of your GRC journey – whether you don’t know where to start; are trying to make sense of the data and risks you have; or don’t know how to best demonstrate actions and progress.

Strategy & Transformation

Having a clear view of where you want to get to is crucial in achieving your security objectives. We will work with you to establish your vision and strategy for information security, and to develop a targeted program of work to meet your strategic objectives, drive improvement and manage risk.

Strategy Definition

What does good look like for your organization? Architecting a clear cyber security strategy will set the direction and clarify your priority objectives for transformational change. An effective strategy will support your business requirements, meet regulatory and legal obligations, and factor in internal considerations, such as capability, budget and other in-flight initiatives. Our team of security consultants will support you in mapping out a vision and strategy, and articulate the required outcomes against which progress can be tracked. With direction set, we’ll develop an actionable program of work that will deliver your strategic objectives and proactively reduce risk across your organization.

Target Operating Model (TOM) Development

An operating model is important in enabling your security team to deliver security outcomes to your organization (and articulate how you’re going to do this in a way that your stakeholders can understand). By developing and implementing your own security operating model you can effectively set priorities and expectations within your team and across your organization, in order to focus on what matters most.

At its core an effective security operating model will:

• Articulate the capabilities (services) provided by the team
• Outline the key inputs, outputs, and dependencies
• Define key roles and responsibilities, and necessary tooling, for delivery and governance
• Set out a development roadmap for enhancement where required

Our security consultants will work closely with you to design and develop the right capabilities and services to be set up for success.

Transformation Planning and Delivery

Whether you require a comprehensive transformation program or targeted improvements, our security consultants have the experience to plan prioritized programs of work. We will work with you to set short, medium and target outcomes, together with a roadmap of activities to achieve them.

Recommended transformation initiatives are focused and prioritized to ensure critical gaps are addressed and any investment decisions that may be required are clearly mapped out alongside the benefits. Our security consultants can work with you to lead on, or support, the delivery of your transformation program.